Detections
Analytics

18.4.7 'MSS: NoNameReleaseOnDemand Allow the computer to ignore NetBIOS name release requests except from WINS servers' is set to 'Enabled'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

NetBIOS over TCP/IP is a network protocol that among other things provides a way to easily resolve NetBIOS names that are registered on Windows-based systems to the IP addresses that are configured on those systems.

This setting determines whether the computer releases its NetBIOS name when it receives a name-release request.

The recommended state for this setting is: 'Enabled'.

Rationale:
The NetBT protocol is designed not to use authentication, and is therefore vulnerable to spoofing.

Spoofing makes a transmission appear to come from a user other than the user who performed the action.

A malicious user could exploit the unauthenticated nature of the protocol to send a name-conflict datagram to a target computer, which would cause the computer to relinquish its name and not respond to queries.

An attacker could send a request over the network and query a computer to release its NetBIOS name.

As with any change that could affect applications, it is recommended that you test this change in a non-production environment before you change the production environment.

The result of such an attack could be to cause intermittent connectivity issues on the target computer, or even to prevent the use of Network Neighborhood, domain logons, the NET SEND command, or additional NetBIOS name resolution.

Solution

To establish the recommended configuration via GP, set the following UI path to 'Enabled':


Computer Configuration\Policies\Administrative Templates\MSS (Legacy)\MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers

Note: This Group Policy path does not exist by default.

An additional Group Policy template ('MSS-legacy.admx/adml') is required - it is available from this TechNet blog post: [The MSS settings -- Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2016/10/02/the-mss-settings/)

Impact:
None - this is the default behavior.

See Also

https://workbench.cisecurity.org/files/1929

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-21, CSCv6|9

Plugin: Windows

Control ID: e061c1fd4c394f422ae1f26853084912637daeccb4065977cfabef9ec6315361