Anonymous users and Windows XP

On computers running Windows XP and later versions of Windows, the Everyone group no longer includes anonymous users by default. This change reduces the number of network resources available by default to anonymous users and simplifies how network administrators can control access by anonymous users. It is easier for administrators to configure a secure system due to the following:

• The default access control lists on earlier versions of Windows that granted the Everyone group access to resources and potentially exposed them to attack does not grant this access to anonymous users after the computer has been upgraded to Windows XP or later versions of Windows.
• Anonymous users cannot be accidentally granted access to resources as in the past when administrators did not realize that anonymous users were included in the Everyone group.

This change affects anonymous users attempting to access resource hosted on computers running Windows XP and later versions of Windows. When a Windows 2000 system is upgraded to Windows XP or a later version of Windows, resources with access control lists that grant access to everyone (and not explicitly to Anonymous Logon) are no longer available to to Anonymous users after the upgrade. In most cases, this is an appropriate restriction on anonymous access. You can still allow anonymous access to selected shared directories and files by adding the Anonymous Logon group to the discretionary access control lists protecting those resources.

In some situations, it might be difficult to determine which resources must grant anonymous access or to modify the permissions on all the necessary resources. If so, you can configure Windows XP and later versions of Windows to permit anonymous access by the Everyone group. For more information, see To allow anonymous access by Everyone under Windows XP.