[EN] Disabling NetBIOS, LLMNR, LMHOSTS and WINS in Windows Domain Environments – Veli Kadir KOZAN (IT Infrastructure Administrator)

When hardening corporate Windows environments, topics such as antivirus, EDR, firewall rules, patch management and password policies usually come to mind first. However, some legacy Windows name resolution mechanisms are often overlooked, even though attackers frequently abuse them inside internal networks.

The most common examples are NetBIOS over TCP/IP, LLMNR, LMHOSTS and, in some legacy environments, WINS.

These components were useful in older networks where DNS was not always available or properly configured. However, in modern Active Directory environments, DNS already handles centralized name resolution. Therefore, keeping these legacy protocols enabled may create an unnecessary attack surface.

For domain-joined workstations and servers, disabling these features should be considered a basic Windows hardening practice.

What Are NetBIOS, LLMNR, LMHOSTS and WINS?

When a Windows system tries to resolve the name of another device, it normally uses DNS first. If DNS fails, Windows may fall back to older name resolution methods. While these mechanisms may seem useful in some scenarios, they can be abused by attackers in corporate networks.

What Is NetBIOS over TCP/IP?

NetBIOS over TCP/IP is a legacy mechanism used in older Windows networks for computer name resolution and certain session communication operations.

In modern Active Directory environments, DNS is the primary and recommended name resolution method. For this reason, NetBIOS is usually no longer required in properly designed domain networks.

However, before disabling it across the entire domain, legacy dependencies should be checked. Some old applications, printers, scanners, file sharing systems or legacy trust relationships may still depend on NetBIOS.

The relevant registry path is generally located under:

HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\Tcpip_{GUID}

The important value is:

NetbiosOptions

Common values are:

0 = Use DHCP setting
1 = Enable NetBIOS over TCP/IP
2 = Disable NetBIOS over TCP/IP

To disable NetBIOS over TCP/IP, the value should be set to:

NetbiosOptions = 2

Because this setting is stored per network adapter, applying it manually on every machine is not practical. In domain environments, it is better to use a startup PowerShell script that loops through all adapters.

What Is LLMNR?

LLMNR, or Link-Local Multicast Name Resolution, is a fallback name resolution protocol. When DNS cannot resolve a name, LLMNR sends multicast queries to devices on the same local subnet.

The problem is that these queries are sent to the local network. A malicious device on the same subnet can respond with a fake answer and redirect the victim machine to itself.

This can lead to attacks such as:

Name resolution poisoning
Credential capture
NTLM relay attacks
SMB relay attacks
Internal network lateral movement

For this reason, LLMNR should be disabled in corporate Windows environments unless there is a specific business requirement.

What Is LMHOSTS?

LMHOSTS is a legacy file-based name resolution method used to map NetBIOS names to IP addresses. It works similarly to the traditional hosts file but is designed for NetBIOS names.

In modern domain environments, LMHOSTS is rarely required. If your organization does not explicitly use an LMHOSTS file, it is recommended to disable LMHOSTS lookup.

The related registry path is:

HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters

The value is:

EnableLMHOSTS

To disable LMHOSTS lookup:

EnableLMHOSTS = 0

What Is WINS?

WINS, or Windows Internet Name Service, is a legacy Microsoft service used to resolve NetBIOS names to IP addresses from a centralized database.

Before DNS became the standard name resolution method in Active Directory environments, WINS was commonly used in Windows networks. Today, most organizations no longer need WINS.

If WINS is not actively used in your environment, static WINS server addresses should be removed from network adapter settings and DHCP options.

WINS settings can be checked from:

Network Adapter Properties
 └─ IPv4 Properties
    └─ Advanced
       └─ WINS

If Primary or Secondary WINS server addresses are configured but not required, they should be removed.

Why Should These Features Be Disabled?

The main goal in a secure domain environment is to make sure that clients use only trusted DNS servers for name resolution.

Protocols such as LLMNR and NetBIOS may broadcast or multicast name resolution requests when DNS fails. An attacker on the same network segment can abuse this behavior by responding to these requests with spoofed answers.

This may allow the attacker to capture authentication attempts or perform relay attacks.

Disabling these legacy protocols helps to:

Reduce the internal attack surface
Prevent name resolution poisoning
Reduce the risk of NTLM credential capture
Reduce the risk of SMB relay attacks
Force clients to use corporate DNS servers
Remove unnecessary legacy dependencies
Improve Windows endpoint hardening

Recommended Domain-Wide Approach

In a domain environment, these settings should not be configured manually on each computer. The recommended approach is to use a combination of Group Policy and startup scripts.

Recommended implementation:

Disable LLMNR using Group Policy.
Disable NetBIOS over TCP/IP using a PowerShell startup script.
Disable LMHOSTS lookup using the same startup script.
Remove static WINS addresses from adapters.
Check DHCP options for WINS-related configurations.
Test the change on a pilot OU.
Apply the configuration gradually to production workstations.
Evaluate servers separately before applying the same settings.

Disabling LLMNR with Group Policy

LLMNR should be disabled using Group Policy.

GPO path:

Computer Configuration
 └─ Policies
    └─ Administrative Templates
       └─ Network
          └─ DNS Client
             └─ Turn off multicast name resolution

This setting should be configured as:

Enabled

This may look confusing at first because the policy name starts with “Turn off”. When you set this policy to Enabled, LLMNR is disabled.

After applying the GPO, the following registry path can be checked on the client:

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient

Expected value:

EnableMulticast = 0

PowerShell command to verify:

Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" |
Select-Object EnableMulticast

If the value is 0, LLMNR has been disabled successfully.

Disabling NetBIOS and LMHOSTS with PowerShell

The following PowerShell script can be deployed as a computer startup script via Group Policy. It disables NetBIOS over TCP/IP on all network adapters and disables LMHOSTS lookup.

# Disable-NetBIOS-LMHOSTS.ps1
# Purpose: Disable NetBIOS over TCP/IP on all adapters and disable LMHOSTS lookup.
# Recommended usage: Deploy as a Computer Startup Script via Group Policy.

$ErrorActionPreference = "SilentlyContinue"

# Disable NetBIOS over TCP/IP on all network interfaces
$netbtInterfacesPath = "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces"

if (Test-Path $netbtInterfacesPath) {
    Get-ChildItem $netbtInterfacesPath | ForEach-Object {
        Set-ItemProperty -Path $_.PSPath -Name "NetbiosOptions" -Type DWord -Value 2
    }
}

# Disable LMHOSTS lookup
$netbtParametersPath = "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters"

if (Test-Path $netbtParametersPath) {
    Set-ItemProperty -Path $netbtParametersPath -Name "EnableLMHOSTS" -Type DWord -Value 0
}

Write-Output "NetBIOS over TCP/IP and LMHOSTS lookup have been disabled. A reboot may be required."

This script can be added to the following GPO location:

Computer Configuration
 └─ Policies
    └─ Windows Settings
       └─ Scripts (Startup/Shutdown)
          └─ Startup

Because this is a computer startup script, it runs before the user logs in and applies the settings at system level.

A reboot is recommended after applying these changes.

How to Verify NetBIOS Status

On a client machine, run:

ipconfig /all

Under the relevant network adapter, check the following line:

NetBIOS over Tcpip . . . . . . . : Disabled

You can also verify the registry values with PowerShell:

Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces" |
ForEach-Object {
    Get-ItemProperty $_.PSPath | Select-Object PSChildName, NetbiosOptions
}

Expected value:

NetbiosOptions : 2

How to Verify LMHOSTS Status

Use the following PowerShell command:

Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" |
Select-Object EnableLMHOSTS

Expected value:

EnableLMHOSTS : 0

How to Verify Group Policy Application

After applying the GPO, run the following command on the client:

gpupdate /force

Then check the applied policies:

gpresult /r

For a more detailed HTML report:

gpresult /h C:\Temp\gpo-report.html

Open the generated report and verify that the related hardening GPO has been applied to the computer.

Important Considerations Before Applying Domain-Wide

These settings should not be applied directly to all domain computers without testing. Some legacy systems or applications may still depend on NetBIOS, WINS or LMHOSTS.

Before rolling out the configuration domain-wide, check the following:

Legacy Windows Server versions
Old ERP or production systems
Legacy printers and scanners
Applications using NetBIOS names instead of DNS names
File shares accessed by short names
Legacy domain trust relationships
Sites or branches using WINS
Manually configured LMHOSTS files
Old industrial or OT systems

The safest approach is to apply the settings first to a pilot OU. After confirming that there are no application, authentication, file share, printer or VPN issues, the policy can be expanded gradually.

Recommended Rollout Plan

1. Prepare an Inventory

Identify systems that may still use NetBIOS, WINS or LMHOSTS. DNS logs, firewall logs, endpoint logs and packet captures can help during this stage.

2. Create a Pilot OU

Create a small test OU with several workstations from different departments. This helps identify application-specific issues early.

3. Create a Dedicated GPO

Create a separate GPO with a clear name, such as:

GPO - Windows Hardening - Disable NetBIOS LLMNR LMHOSTS

Apply the LLMNR policy and add the startup script to the same GPO.

4. Test Client Functionality

On pilot machines, test the following:

User logon
File share access
Printer access
Application access
VPN connectivity
DNS name resolution
Remote management tools
Backup agents
Monitoring agents

5. Expand Gradually

If no issues are detected, apply the policy first to IT workstations, then to general user workstations. Servers should be evaluated separately and preferably changed during a maintenance window.

6. Monitor Network Traffic

After deployment, monitor for traffic related to:

UDP 137  - NetBIOS Name Service
UDP 138  - NetBIOS Datagram Service
TCP 139  - NetBIOS Session Service
UDP 5355 - LLMNR

Unexpected traffic on these ports may indicate unmanaged systems, policy application issues or legacy dependencies.

Additional Security Recommendations

Disabling NetBIOS, LLMNR, LMHOSTS and WINS is an important step, but it should be part of a broader Windows hardening strategy.

Additional recommendations include:

Enable SMB Signing.
Reduce NTLM usage wherever possible.
Disable NTLM where business requirements allow.
Ensure all clients use only corporate DNS servers.
Review and disable WPAD if it is not required.
Segment the internal network.
Use EDR or NDR tools to detect poisoning attempts.
Do not use Domain Admin accounts on workstations.
Manage local administrator passwords with Windows LAPS.
Monitor authentication anomalies.
Review legacy application dependencies regularly.

NetBIOS, LLMNR, LMHOSTS and WINS were useful in older Windows networks, but in modern Active Directory environments they often create unnecessary security risks.

If DNS is properly configured and legacy dependencies have been reviewed, these mechanisms should be disabled on domain-joined devices.

In summary:

Disable NetBIOS over TCP/IP.
Disable LLMNR using Group Policy.
Disable LMHOSTS lookup.
Remove unnecessary WINS addresses.
Test the configuration on a pilot OU first.
Roll out the settings gradually.
Monitor for legacy traffic and application issues.

Although these changes may seem small, they can significantly reduce the risk of internal name resolution poisoning, credential capture and relay-based attacks. For this reason, disabling these legacy protocols should be considered a standard part of Windows domain hardening.

Comments

Leave a Reply Cancel reply