Home / server / Questions / 952841
Accepted
FRALEWHALE
Asked: 2019-02-08 11:34:38 +0800 CST

Verifying that LLMNR is disabled - GPO

  • 772

I am attempting to disable LLMNR on all of our endpoints. I found an article describing the process here.

Essentially the process goes like -

Create GPO -> Computer Configuration -> Administrative Templates -> Network -> DNS Client Enable Turn Off Multicast Name Resolution policy by changing its value to Enabled

So I applied the GPO and then I ran gpupdate /force on my machine to update it to the last GPOs. Then I ran gpresult /Scope Computer /v and the output lists the GPO as:

GPO: Disable LLMNR Folder Id: SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\EnableMulticast Value: 0, 0, 0, 0 State: Enabled

Which to me look as if the GPO is getting applied. But it does not look like it is actually enforcing it. Hence the value of 0.0.0.0.

Is there any method I can test to see if it is working?

windows

2 Answers

  1. Best Answer

    The Value field in the output of GPResult (0, 0, 0, 0 in your case, which is not the same as 0.0.0.0) does not indicate that the Group Policy is not being enforced. Rather, it is a field that displays any additional information related to the settings of a GPO.

    For example, I've got a GPO that shows this in the Value portion of GPResult:

    Value:   104, 0, 116, 0, 116, 0, 112, 0, 115, 0, 58, 0, 47, 0, 47, 0, ...

    Those are ASCII values (104='h', 116='t', 116='t', 112='p', 115='s', 58=':', and so on) that show that the value of a setting related to that GPO is https://....

    Because the EnableMulticast setting only has Enabled or Disabled, there is no additional information to be displayed in the Value field. The line that tells you State: Enabled is what you need to know.

    If you want to examine a client and confirm that the GPO had the desired effect, you can look at the registry. Look for EnableMulticast inside HKLM\Software\Policies\Microsoft\Windows NT\DNSClient. If it is 0, then Multicast Name Resolution is not enabled.

    • 4

  2. Just to add to this, every article I read suggests that 1 is disabled and 0 is enabled for this EnableMulticast Value, despite the Value name suggesting it is the other way round.

    I did look at several articles to verify, because with a name like EnableMulticast you would expect it to be the other way round.

    • 1