Detections
Analytics
18.5.9.2 Ensure 'Turn on Responder (RSPNDR) driver' is set to 'Disabled' (EnableRspndr)
Warning! Audit Deprecated
This audit has been deprecated and will be removed in a future update.
View Next Audit VersionInformation
This policy setting changes the operational behavior of the Responder network protocol driver.The Responder allows a computer to participate in Link Layer Topology Discovery requests so that it can be discovered and located on the network.
It also allows a computer to participate in Quality-of-Service activities such as bandwidth estimation and network health analysis.
The recommended state for this setting is: 'Disabled'.
Rationale:
To help protect from potentially discovering and connecting to unauthorized devices, this setting should be disabled to prevent responding to network traffic for network topology discovery.
Solution
To establish the recommended configuration via GP, set the following UI path to 'Disabled':Computer Configuration\Policies\Administrative Templates\Network\Link-Layer Topology Discovery\Turn on Responder (RSPNDR) driver
Note: This Group Policy path is provided by the Group Policy template 'LinkLayerTopologyDiscovery.admx/adml' that is included with all versions of the Microsoft Windows Administrative Templates.
Impact:
None - this is the default behavior.
See Also
Item Details
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-7, CSCv6|9, CSCv6|9.1
Plugin: Windows
Control ID: 0d14f981220bed8ad6cd4fef8a091dc1260c2b932e905e517ec657f72baa707c