1

I am attempting to disable LLMNR on all of our endpoints. I found an article describing the process here.

Essentially the process goes like -

Create GPO -> Computer Configuration -> Administrative Templates -> Network -> DNS Client Enable Turn Off Multicast Name Resolution policy by changing its value to Enabled

So I applied the GPO and then I ran gpupdate /force on my machine to update it to the last GPOs. Then I ran gpresult /Scope Computer /v and the output lists the GPO as:

GPO: Disable LLMNR Folder Id: SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\EnableMulticast Value: 0, 0, 0, 0 State: Enabled

Which to me look as if the GPO is getting applied. But it does not look like it is actually enforcing it. Hence the value of 0.0.0.0.

Is there any method I can test to see if it is working?

  • Fascinating. The first 3 articles I read (including a Microsoft article) said set it to 1 to disable, even though that goes against the name and 1=True/On,0=False/Off. Following seeing your response I find 3 new articles that agree with you. A quick GP set change verifies what you said. Thank you! The only reason I needed to do this via the registry is because for some reason setting the group policy option also creates an empty DnsPolicyConfig Key, which then breaks the NRPT table for DirectAccess and AlwaysOn. – Anthony Jun 30 '20 at 16:54
3

The Value field in the output of GPResult (0, 0, 0, 0 in your case, which is not the same as 0.0.0.0) does not indicate that the Group Policy is not being enforced. Rather, it is a field that displays any additional information related to the settings of a GPO.

For example, I've got a GPO that shows this in the Value portion of GPResult:

Value:   104, 0, 116, 0, 116, 0, 112, 0, 115, 0, 58, 0, 47, 0, 47, 0, ...

Those are ASCII values (104='h', 116='t', 116='t', 112='p', 115='s', 58=':', and so on) that show that the value of a setting related to that GPO is https://....

Because the EnableMulticast setting only has Enabled or Disabled, there is no additional information to be displayed in the Value field. The line that tells you State: Enabled is what you need to know.

If you want to examine a client and confirm that the GPO had the desired effect, you can look at the registry. Look for EnableMulticast inside HKLM\Software\Policies\Microsoft\Windows NT\DNSClient. If it is 0, then Multicast Name Resolution is not enabled.

  • Thank you! For some reason I was under the impression that the result of 0 meant that it was not enabled. – FRALEWHALE Feb 8 '19 at 13:21
0

Just to add to this, every article I read suggests that 1 is disabled and 0 is enabled for this EnableMulticast Value, despite the Value name suggesting it is the other way round.

I did look at several articles to verify, because with a name like EnableMulticast you would expect it to be the other way round.

  • 2
    Those mysterious articles are wrong. All you need to do is configure the policy and check the registry value. – Greg Askew Jun 30 '20 at 16:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.