Detections
Analytics

18.5.19.2.1 Disable IPv6 (Set TCPIP6 Parameter 'DisabledComponents' to '0xff (255)')

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Internet Protocol version 6 (IPv6) is a set of protocols that computers use to exchange information over the Internet and over home and business networks.

IPv6 allows for many more IP addresses to be assigned than IPv4 did.

Older networking, hosts and operating systems may not support IPv6 natively.

The recommended state for this setting is: 'DisabledComponents - 0xff (255)'

Rationale:
Since the vast majority of private enterprise managed networks have no need to utilize IPv6 (because they have access to private IPv4 addressing), disabling IPv6 components reduces a possible attack surface that is also harder to monitor the traffic on.

As a result, we recommend configuring IPv6 to a Disabled state when it is not needed.

Solution

To establish the recommended configuration, set the following Registry value to '0xff (255) (DWORD)':


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TCPIP6\Parameters:DisabledComponents


Note: This change does not take effect until the computer has been restarted.

Note #2: Although Microsoft does not provide an ADMX template to configure this registry value, a custom .ADM template ('Disable-IPv6-Components-KB929852.adm') is provided in the CIS Benchmark Remediation Kit to facilitate its configuration.

Be aware though that simply turning off the group policy setting in the .ADM template will not 'undo' the change once applied.

Instead, the opposite setting must be applied to change the registry value to the opposite state.

Impact:
Connectivity to other systems using IPv6 will no longer operate, and software that depends on IPv6 will cease to function.

Examples of Microsoft applications that may use IPv6 include: Remote Assistance, HomeGroup, DirectAccess, Windows Mail.

This registry change is documented in Microsoft Knowledge Base article 929852: [How to disable IPv6 or its components in Windows](https://support.microsoft.com/en-us/kb/929852).

Note: This registry change does not take effect until the next reboot.

See Also

https://workbench.cisecurity.org/files/1937

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7, CSCv6|9, CSCv6|9.2

Plugin: Windows

Control ID: 71f41b8d2d279ee719ec1d2f478435909193d82101cd3b8ebbf99fd5a63ba53c