Retire LLMNR, NBT-NS, SMBv1 and NTLMv1; require signing

Windows keeps a long tail of protocols for backwards compatibility. Several of them hand an attacker on the local network exactly what they need:

• LLMNR, NBT-NS and mDNS answer name lookups by broadcast. Anyone on the segment can reply "that's me" and receive an authentication attempt with the user's NetNTLM hash.
• Unsigned SMB and LDAP let that captured authentication be relayed to another server in real time, often yielding admin access without cracking anything.
• LM and NTLMv1 responses can be cracked or downgraded quickly.
• SMBv1 is unmaintained and was the vector for WannaCry and NotPetya.

Each section below shows how to measure first, then disable or enforce.

LLMNR

Link-Local Multicast Name Resolution is used when DNS fails to resolve a name.

• GPO: Computer Configuration > Administrative Templates > Network > DNS Client > Turn off multicast name resolution = Enabled.
• Registry: HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient EnableMulticast = 0 (DWORD).

There is essentially no legitimate use of LLMNR in a domain. Roll it out everywhere at once.

NetBIOS name service (NBT-NS)

NBT-NS is configured per network adapter, which makes it awkward to manage:

• DHCP: set Microsoft vendor option 001 Microsoft Disable Netbios Option to 0x2 on your DHCP scopes. Clients using DHCP pick it up at lease renewal.
• Static adapters / servers: set NetbiosOptions = 2 under every interface key in HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\Tcpip_{GUID}. A startup script is the usual way:

Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces" |
  ForEach-Object { Set-ItemProperty -Path $_.PSPath -Name NetbiosOptions -Value 2 }

Check that nothing still depends on NetBIOS names: very old applications, some printers and scanners, and WINS-based setups. If you still run WINS servers, decommissioning them is part of this project.

mDNS and WPAD

• mDNS: current Windows versions also respond to multicast DNS. Blocking inbound UDP 5353 with the host firewall on managed networks is the most reliable control; many baselines also set EnableMDNS = 0 under HKLM\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters.
• WPAD (Web Proxy Auto-Discovery) lets a client look up a proxy configuration by name, which an attacker can answer. If you don't use WPAD, disable automatic proxy detection by policy and make sure wpad is in the DNS server global query block list (it is by default on Windows DNS servers; check nobody removed it with dnscmd /info /globalqueryblocklist). If you do use WPAD, publish an authoritative wpad DNS record so nobody else can claim it.

SMBv1

SMBv1 has not been installed by default since Windows 10 1709 and Windows Server 2019, but upgrades and old images carry it forward.

Find who still uses it by auditing on file servers first:

Set-SmbServerConfiguration -AuditSmb1Access $true -Force
# then read Microsoft-Windows-SMBServer/Audit, event 3000 (a client connected with SMBv1)

Then remove it:

Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart   # clients
Remove-WindowsFeature FS-SMB1                                                 # servers
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol                 # verify: False

Typical holdouts are multifunction printers scanning to a share, old NAS devices and industrial systems. Upgrade their firmware or isolate them; do not keep SMBv1 on your whole estate for one scanner.

SMB signing

Signing prevents SMB relay and tampering. Set it to required on both sides:

Paths: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options. PowerShell equivalents:

Set-SmbClientConfiguration -RequireSecuritySignature $true -Force
Set-SmbServerConfiguration -RequireSecuritySignature $true -Force

Domain controllers have required server-side signing for a long time. Windows 11 24H2 (Enterprise, Pro and Education) now requires signing by default both outbound and inbound, and Windows Server 2025 requires it outbound, so newer machines will already refuse third-party NAS devices that don't sign, and required signing also blocks guest access to shares; plan for this rather than being surprised by it. For sensitive shares, SMB 3 encryption (Set-SmbShare -Name Finance -EncryptData $true) goes further.

LDAP signing and channel binding

Unsigned LDAP binds and LDAPS without channel binding allow NTLM relay to domain controllers, one of the most damaging relay targets.

1. Audit first. On each DC, enable diagnostic logging for LDAP interface events: HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics 16 LDAP Interface Events = 2. Then look for events 2889 (client performed an unsigned or simple bind in cleartext) in the Directory Service log. Event 2887 gives a daily summary count.
2. Require signing: Domain controller: LDAP server signing requirements = Require signing (on the Default Domain Controllers Policy) and Network security: LDAP client signing requirements = Negotiate signing or higher on members.
3. Channel binding for LDAPS: Domain controller: LDAP server channel binding token requirements = When supported, then Always once audit events (3039, 3040, 3041) show no incompatible clients.

NTLM: refuse the old versions, then shrink the rest

Refuse LM and NTLMv1

Network security: LAN Manager authentication level = Send NTLMv2 response only. Refuse LM & NTLM (registry HKLM\SYSTEM\CurrentControlSet\Control\Lsa LmCompatibilityLevel = 5). Apply to all machines including DCs. Also set Network security: Do not store LAN Manager hash value on next password change = Enabled.

Before you flip it on DCs, find NTLMv1 users: security event 4624 includes Package Name (NTLM only); filter for NTLM V1:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} -MaxEvents 20000 |
  Where-Object { $_.Message -match 'NTLM V1' } |
  Select-Object TimeCreated, @{n='Detail';e={($_.Message -split "`n" | Select-String 'Workstation Name|Account Name|Source Network Address') -join '; '}}

Audit and restrict NTLMv2

• Network security: Restrict NTLM: Audit NTLM authentication in this domain = Enable all (on DCs).
• Network security: Restrict NTLM: Audit Incoming NTLM Traffic = Enable auditing for all accounts (on servers).
• Read Applications and Services Logs > Microsoft > Windows > NTLM > Operational (events 8001-8004) to see which clients and servers still use NTLM, and why (usually connecting by IP address, missing SPNs, or non-domain devices).

Then reduce it: fix SPNs and DNS names so Kerberos works, add privileged users to Protected Users (no NTLM at all), and use Restrict NTLM: Incoming NTLM traffic = Deny all accounts on servers that have no legitimate NTLM clients. Add Extended Protection for Authentication on IIS, AD CS web enrollment and Exchange, which binds NTLM to the TLS channel and defeats relay to those services.

Order of operations

Checklist

• LLMNR off by GPO; NBT-NS off via DHCP and on static adapters
• mDNS blocked, WPAD disabled or authoritatively published
• SMBv1 removed; audit showed no remaining clients
• SMB signing required on clients and servers
• LDAP signing required, channel binding set to Always
• LmCompatibilityLevel 5 everywhere, LM hashes not stored
• NTLM audited; Protected Users and EPA reduce the remaining attack surface

These changes close the attacks that turn "someone plugged into the network" into "someone owns the domain". Pair them with host firewall rules that stop workstations talking SMB to each other at all.