title: Null session pipes example, write access
body: <p>I'm looking for a simple example of how to create a null session pipe, that can be read from or written to by clients on another PC through lan. </p>
  
  <p>I've found this MSDN <a href="https://support.microsoft.com/en-us/help/813414/how-to-create-an-anonymous-pipe-that-gives-access-to-everyone" rel="nofollow noreferrer">article</a>, but the code there only provides read access to the pipe. I've tried to make it work for writing: changing <code>PIPE_ACCESS_OUTBOUND</code> to <code>PIPE_ACCESS_DUPLEX</code> (<code>CreateNamedPipe</code> argument), <code>FILE_GENERIC_READ</code> to <code>GENERIC_READ | GENERIC_WRITE</code> (<code>AddAccessAllowedAce</code> argument), and <code>GENERIC_READ</code> to <code>GENERIC_READ | GENERIC_WRITE</code> (<code>CreateFile</code> argument), but I'm getting an ACCESS_DENIED (5) error when trying to call <code>CreateFile</code> in the client program. Though opening a pipe only for reading works correctly.</p>
  
  <p>The server is launched on Windows 7 machine and the client on Windows XP. </p>
  
  <p>Here is my Windows 7 registry key (<code>NullSessionPipes</code> contains testpipe and  AnonymousPipe strings). Maybe something there causes the problem?</p>
  
  <pre><code>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\Parameters]
  "ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
    00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
    73,00,72,00,76,00,73,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00
  "ServiceDllUnloadOnStop"=dword:00000001
  "EnableAuthenticateUserSharing"=dword:00000001
  "NullSessionPipes"=hex(7):74,00,65,00,73,00,74,00,70,00,69,00,70,00,65,00,00,\
    00,41,00,6e,00,6f,00,6e,00,79,00,6d,00,6f,00,75,00,73,00,50,00,69,00,70,00,\
    65,00,00,00,00,00
  "autodisconnect"=dword:0000000f
  "enableforcedlogoff"=dword:00000001
  "enablesecuritysignature"=dword:00000000
  "requiresecuritysignature"=dword:00000000
  "restrictnullsessaccess"=dword:00000000
  "Lmannounce"=dword:00000000
  "Size"=dword:00000001
  "AdjustedNullSessionPipes"=dword:00000003
  "Guid"=hex:eb,c5,75,fd,46,51,ce,4c,8f,64,a9,70,12,f6,05,6e
  </code></pre>
  
  <p>Could you give me the correct null session pipe example, or tell me how to edit the MSDN example?</p>
  
  <p><strong>Update</strong></p>
  
  <p>Here is what I've already tried:</p>
  
  <ol>
  <li><code>FILE_GENERIC_READ | FILE_WRITE_DATA</code> in both <code>AddAccessAllowedAce</code> and <code>CreateFile</code> as @HarryJohnston suggested</li>
  <li><code>GENERIC_ALL</code> in <code>AddAccessAllowedAce</code></li>
  <li>Null DACL: <code>SetSecurityDescriptorDacl(sa.lpSecurityDescriptor, TRUE, NULL, FALSE)</code></li>
  </ol>
  
  <p>But I haven't managed to open a pipe for writing. (ACCESS_DENIED error). pipesec.exe shows that all necessary permissions are present: "Write Data" in case of <code>FILE_GENERIC_READ | FILE_WRITE_DATA</code> and additionally "Write Attributes" and "Write Extended attributes" in case of <code>GENERIC_READ|GENERIC_WRITE</code>.</p>
  
  <p>When I launch the server on XP and client on Windows 7 I get no errors. </p>
  
  <p><strong>Update 2</strong></p>
  
  <p>When I either enable "Network access: Let Everyone permissions apply to anonymous users" setting, or grant "Impersonate a client after authentication" user right to the ANONYMOUS LOGON group, I get no errors. This is strange because impersonation functions are not used anywhere in the MSDN example.</p>