Aligning on mDNS: ramping down NetBIOS name resolution and LLMNR

It's great to see Microsoft Security baselines disable multicast name resolution.

Tom_S mDNS has defined way to solve name conflicts, which are expected to happen. In my view primary advantage of mdns is it has own special domain .local. That should not be used for unicast DNS or any names in it, therefore any mDNS responder cannot forge name like example.net or example.org. They are never sent over multicast.

LLMNR and Netbios used just bare name. In that sense name router. might be provided by network unicast DNS server or LLMNR. If there is defined domain suffix, it should first try DNS, then LLMNR. But with mDNS local responder is not offered to answer names except in .local zone. But in Zero Trust environment using things like mDNS might make sense only when accompanied by secure protocols like TLS, which can ensure the remote point is indeed who we expect. If you want security, use DNS. Or better, use also DNSSEC.

Hello, I am software engineer at Red Hat. I have prepared a change to systemd-resolved in reaction of this article, but I haven't found a way to tell whether LLMNR resolution on my windows machine is still active or already not. Does Netbios and LLMNR share the same registry key? Is there a way to tell LLMNR status from command line? Can ipconfig or netsh display whether it should work?

The article is almost a year old. Has it been already published outside insider builds? Is it already offered to normal users? I know where to look for various Linux distributions, but I don't know where to look for Microsoft systems. Can you please direct me to any related resources, if they are public?

Hey Tom_S 

Zero Trust Architecture states you can't trust the network because there's no perimeter anymore,

That's correct, and when deploying Windows within a ZT environment, multicast name resolution simply shouldn't be used at all, end of story. There aren't any realistic ways for anyone to make multicast name resolution ZT friendly given its nature (crowd-sourced answer seeking, essentially). With mDNS/LLMNR/NetBIOS name resolution disabled, all queries will go over the configured unicast servers.

As for the policy of apps, that's beyond our team's scope, but I'll point out that Edge already brings its own policy that can be used to force it to always use the system DNS resolver, as does every other major browser I know of.

When admins configure their apps and limit software installations to ensure the system resolver is always used, I believe our existing logs will give you what you're looking for, which is also a data source for products such as Defender.

tojens 

What mechanisms is Microsoft adding to combat hostile mDNS respondents from spoofing legitimate hostnames already registered in the DNS?  Will client name resolution after NetBIOS & LLMNR shutdown still rely on a first method with a response wins?  Zero Trust Architecture states you can't trust the network because there's no perimeter anymore, but my understanding of mDNS (& the mDNS in the Enterprise blog entry) is that it assumes a secure muticast domain.  This leaves only the option of client-side firewall rules for protection.

1) What about giving us a config option in DNS cache, or even domain TXT records, so that the OS's mDNS element is a proxy to  managed DNS servers?

2) Then admins are responsible for IP devices being dynamically registered in the DNS either by the host or by the issuing DHCP server.  That also preserves & provides secure Domain and/or DNSSEC resolution protection.

3) Require 1st party (MS) apps & devices to use the OS resolver instead of rolling their own.  This is just common sense, c.f. why browser based dns clients are a bad idea.  Then, admins can pursue & control 3rd party mDNS resolvers as needed.

4) Mining centralized DNS server logs for queries is a valuable source of threat hunting.  Ensure Windows' mDNS logs activity in a fashion that can support those investigation objectives.

Thank you.

Background:  I have more than a few year history with mixed Mac & Windows in operations & security.  Pretty strong familiarity with Bonjour/mDNS & other dynamic resolution protocols.

Jason_Palazzo I've not encountered any trouble unbinding (clearing the checkbox) or uninstalling LLMNR.

Additionally, use Microsoft vendor DHCP options to disable NetBIOS over TCP/IP across a network, or individually disable it by interface.

Since XP/ Server 2k3, running SMB/445 only & DNS primarily for name resolution.

Brian Steingraber that is correct.

Tommy,

Assuming then that the Registry key also does nothing on prior Windows 11/10 builds?

Hey Jason_Palazzo because this feature is in Windows 11 Insider builds only, it is not part of any previous product release, including Windows 10. You will need to test out the feature using Insider builds available at https://insider.windows.com/ 

Where do you download the ADMX for this setting? I tried downloading the latest Windows 10 ADMX files "Administrative Templates (.admx) for Windows 10 November 2021 Update.msi" and updating our central store but this policy does not show up. I also checked a Windows 11 workstation and the policy is not present either.