WN11-CC-000035 - The system must be configured to ignore NetBIOS name release requests except from WINS servers.

Information

Configuring the system to ignore name release requests, except from WINS servers, prevents a denial of service (DoS) attack. The DoS consists of sending a NetBIOS name release request to the server for each entry in the server's cache, causing a response delay in the normal operation of the servers WINS resolution capability.

Solution

Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> 'MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers' to 'Enabled'.

This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. 'MSS-Legacy.admx' and 'MSS-Legacy.adml' must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_11_V1R2_STIG.zip

Item Details

References: CAT|III, CCI|CCI-002385, Rule-ID|SV-253356r829152_rule, STIG-ID|WN11-CC-000035, Vuln-ID|V-253356

Plugin: Windows

Control ID: 59e60a04011e698b352c84633ea666c682a0ec547348495876bec95191946946