Skip to content

Instantly share code, notes, and snippets.

@joswr1ght
Created October 9, 2019 14:26
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 2 You must be signed in to fork a gist
  • Save joswr1ght/39eb7a2e69a593f6a938de6ccf988a57 to your computer and use it in GitHub Desktop.
Save joswr1ght/39eb7a2e69a593f6a938de6ccf988a57 to your computer and use it in GitHub Desktop.
Disable WPAD and LLMNR on Windows
REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad"
REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad" /v "WpadOverride" /t REG_DWORD /d "1" /f
REG ADD "HKLM\Software\policies\Microsoft\Windows NT\DNSClient"
REG ADD "HKLM\Software\policies\Microsoft\Windows NT\DNSClient" /v "EnableMulticast" /t REG_DWORD /d "0" /f
@joswr1ght
Copy link
Author

Run these commands on Windows as an administrator to stop WPAD and LLMNR attacks (e.g. the Responder attack).

@esecrpm
Copy link

esecrpm commented Apr 28, 2023

Don't forget to disable mDNS as well (from https://f20.be/blog/mdns)

REG ADD "HKLM\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters" /v " EnableMDNS" /t REG_DWORD /d "0" /f

@Tntdruid
Copy link

Many thanks for this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment