Policies/

Link-Local Multicast Name Resolution (LLMNR) disabled

Josh Brower

Checks if a Group Policy configures the computer to disable LLMNR. Disabling LLMNR can prevent malicious actors from gaining access to the computer's credentials. Some auditors require that this setting is configured by a Group Policy.

Control

Create or edit a configuration profile with the following information:

Create or edit the following script and configure it to run when the check fails:

Check

Use the policy below to verify:

Query PowerShellNEW BashNEW

SELECT 1 FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\EnableMulticast' AND CAST(data as integer) = 0;

$regPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient'
$value = (Get-ItemProperty -Path $regPath -Name 'EnableMulticast' -ErrorAction SilentlyContinue).EnableMulticast
if ($value -eq 0) {
    Write-Output 1
} else {
    Write-Output 0
}