LLMNR Poisoning Possible

Table of Contents

• Option 1: Disable via Group Policy
• Option 2: Disable on Selected Hosts

Option 1: Disable via Group Policy.

1. Open the "Local Group Policy Editor" on the Domain Controller.
2. Navigate to Computer Configuration > Administrative Templates > Network > DNS Client and then selecting: Turn Off Multicast Name Resolution
   
3. Click Enabled and select OK
   

---

Option 2: Disable on Selected Hosts

1. Log onto the host and open an Administrative Command Prompt
2. Disable LLMNR by disabling the "EnableMulticast" registry key with the following commands:

   REG ADD "HKLM\Software\policies\Microsoft\Windows NT\DNSClient"
   REG ADD "HKLM\Software\policies\Microsoft\Windows NT\DNSClient" /v "EnableMulticast" /t REG_DWORD /d "0" /f