๐ Secure Bits ๐ก
๐๐ผ ๐๐ผ๐ ๐ฑ๐ถ๐๐ฎ๐ฏ๐น๐ฒ ๐ก๐ฒ๐๐๐๐ข๐ฆ, ๐๐๐ ๐ก๐ฅ & ๐๐ ๐๐ข๐ฆ๐ง๐ฆ (๐ฎ๐ป๐ฑ ๐ช๐๐ก๐ฆ)?
You shouldโthis is basic Windows hardening for domain devices.
๐ช๐ต๐ฎ๐ ๐๐ผ ๐๐๐ฟ๐ป ๐ผ๐ณ๐ณ (๐ฎ๐ป๐ฑ ๐ต๐ผ๐):
๐น ๐ก๐ฒ๐๐๐๐ข๐ฆย โ legacy naming/session protocol. GPOs are hit-or-miss; set the registry per adapter (use a startup script to loop all adapters):
๐๐๐๐\๐๐ ๐๐๐๐\๐๐ถ๐ณ๐ณ๐ฆ๐ฏ๐ต๐๐ฐ๐ฏ๐ต๐ณ๐ฐ๐ญ๐๐ฆ๐ต\๐๐ฆ๐ณ๐ท๐ช๐ค๐ฆ๐ด\๐๐ฆ๐ต๐๐\๐๐ข๐ณ๐ข๐ฎ๐ฆ๐ต๐ฆ๐ณ๐ด\๐๐ฏ๐ต๐ฆ๐ณ๐ง๐ข๐ค๐ฆ๐ด\{๐๐๐๐}\๐๐ฆ๐ต๐ฃ๐ช๐ฐ๐ด๐๐ฑ๐ต๐ช๐ฐ๐ฏ๐ด=2
๐น ๐ช๐๐ก๐ฆย โ only matters if NetBIOS over TCP/IP is enabled. Remove any static WINS addresses in the adapter settings.
๐น ๐๐๐ ๐ก๐ฅย โ DNS fallback on the local subnet. Disable via GPO:
๐๐ฐ๐ฎ๐ฑ๐ถ๐ต๐ฆ๐ณ ๐๐ฐ๐ฏ๐ง๐ช๐จ๐ถ๐ณ๐ข๐ต๐ช๐ฐ๐ฏ โ ๐๐ฐ๐ญ๐ช๐ค๐ช๐ฆ๐ด โ ๐๐ฅ๐ฎ๐ช๐ฏ๐ช๐ด๐ต๐ณ๐ข๐ต๐ช๐ท๐ฆ ๐๐ฆ๐ฎ๐ฑ๐ญ๐ข๐ต๐ฆ๐ด โ ๐๐ฆ๐ต๐ธ๐ฐ๐ณ๐ฌ โ ๐๐๐ ๐๐ญ๐ช๐ฆ๐ฏ๐ต โ ๐๐ถ๐ณ๐ฏ ๐ฐ๐ง๐ง ๐ฎ๐ถ๐ญ๐ต๐ช๐ค๐ข๐ด๐ต ๐ฏ๐ข๐ฎ๐ฆ ๐ณ๐ฆ๐ด๐ฐ๐ญ๐ถ๐ต๐ช๐ฐ๐ฏ
๐น ๐๐ ๐๐ข๐ฆ๐ง๐ฆย โ NetBIOS โhostsโ file. Disable:
๐๐๐๐\๐๐ ๐๐๐๐\๐๐ถ๐ณ๐ณ๐ฆ๐ฏ๐ต๐๐ฐ๐ฏ๐ต๐ณ๐ฐ๐ญ๐๐ฆ๐ต\๐๐ฆ๐ณ๐ท๐ช๐ค๐ฆ๐ด\๐๐ฆ๐ต๐๐\๐๐ข๐ณ๐ข๐ฎ๐ฆ๐ต๐ฆ๐ณ๐ด\๐๐ฏ๐ข๐ฃ๐ญ๐ฆ๐๐๐๐๐๐๐=0.
โ
๐ฅ๐ฒ๐ฐ๐ผ๐บ๐บ๐ฒ๐ป๐ฑ๐ฒ๐ฑ domain-wide approach:
Startupย PowerShellย script to set NetBIOSย Disabledย on every adapter and turn off LMHOSTS. GPO toย Turn off multicast name resolutionย (LLMNR).
Apply, reboot and test.
๐ ๐๐๐น๐น ๐ด๐๐ถ๐ฑ๐ฒ + ๐ฟ๐ฒ๐ฎ๐ฑ๐-๐๐ผ-๐๐๐ฒ ๐๐ฐ๐ฟ๐ถ๐ฝ๐:ย I put the exact steps and the script into my Windows Infrastructure Security guides:
https://lnkd.in/egS2kbMM
