LLMNR Poisoning Possible

Table of Contents

• Option 1: Disable via Group Policy
• Option 2: Disable on Selected Hosts

Option 1: Disable via Group Policy.

1. Open the “Local Group Policy Editor” on the Domain Controller.
2. Navigate to Computer Configuration > Administrative Templates > Network > DNS Client and then selecting “Turn Off Multicast Name Resolution” 
3. Click “Enabled” and select “Ok” 

Option 2: Disable on Selected Hosts

1. Log onto the host and open an Administrative Command Prompt
2. Disable LLMNR by disabling the “EnableMulticast” registry key with the following commands:

REG ADD "HKLM\Software\policies\Microsoft\Windows NT\DNSClient"
REG ADD "HKLM\Software\policies\Microsoft\Windows NT\DNSClient" /v " EnableMulticast" /t REG_DWORD /d "0" /f