LLMNR not disabled on Windows Server 2019

Question

Hello,

I have a gpo to disable LLMNR, NBT-NS, WPAD, IPv6 on all my servers, the GPO works fine Windows all 2016 server, but it's doesn't with 2019 server.

The registry key to disable LLMNR is already existe with value 0, but Won't not take it into consideration.

Here are the registry values from one of my 2019 Servers.

GPO : Sec_Disable_LLMNR_WPAD_mDNS_IPv6

            ID de dossier: Software\Policies\Microsoft\Windows NT\DNSClient\EnableMulticast 

            Valeur:       0, 0, 0, 0 

            Etat :       Activ‚

Here is the result from the responder.

Answer 1

Hello,

I had to disable Netbios on the connected NIC, i think there is something wrong windows Windows Server 2019.

I will test on Windows server 2016 if it will also need to disable Netbios.

Answer 2

i had to disable NETBIOS on NIC to mitigate the attack.

LLMNR = Disable, Netbios = Enable => injection done (My Case)

LLMNR = Enable, Netbios = disabled => injection done

LLMNR = Disable, Netbios = disabled => attack stopped