Windows 11 Network: 27 Checks

Checks whether the DNS client is prevented from using the default IPv6 DNS server addresses provided by Windows.

This rule fails when disableIPv6DefaultDnsServers is not true.

Rationale: Most enterprise networks rely on private IPv4 addressing; disabling the built-in IPv6 DNS servers removes an attack surface whose traffic is harder to monitor.

Impact: Windows will not use the default IPv6 DNS server addresses.

Checks whether Windows is prevented from downloading fonts and font catalog data from an online font provider.

This rule fails when enableFrontProviders is not false.

Rationale: In a managed environment all system changes should be tested and approved by IT; blocking on-demand font downloads keeps the endpoint from reaching an external provider.

Impact: Windows enumerates only locally installed fonts and will not contact an online font provider.

Checks whether the SMB server logs an event when a connecting SMB client does not support encryption.

This rule fails when lanmanServerAuditClientDoesNotSupportEncryption is not true.

Rationale: Visibility into unencrypted SMB traffic lets defenders find legacy clients that expose the environment to interception attacks.

Impact: Each connection from a client that lacks encryption support is recorded as an audit event.

Checks whether the SMB server logs an event when a connecting SMB client does not support signing.

This rule fails when lanmanServerAuditClientDoesNotSupportSigning is not true.

Rationale: Awareness of unsigned SMB traffic helps identify legacy clients that leave the environment open to interception and tampering attacks.

Impact: Each connection from a client that lacks signing support is recorded as an audit event.

Checks whether the SMB server logs an event when a client connects using the guest account.

This rule fails when lanmanServerAuditInsecureGuestLogon is not true.

Rationale: Insecure guest logons allow unauthenticated access to shares; auditing them surfaces this risky access pattern.

Impact: Each insecure guest logon to the SMB server is recorded as an audit event.

Checks the delay the SMB server enforces after an invalid authentication attempt.

This rule fails when lanmanServerInvalidAuthDelayTime is less than 2000000000 ns (2000 milliseconds).

Rationale: A delay of at least two seconds between failed NTLM or PKU2U attempts makes SMB brute-force attacks impractically slow.

Impact: None; 2000 milliseconds (two seconds) is the default behavior.

Checks whether the SMB server authentication rate limiter, which throttles repeated failed authentication attempts, is enabled.

This rule fails when lanmanServerEnableAuthRateLimiter is not true.

Rationale: Inserting a delay between failed NTLM or PKU2U authentication attempts dramatically slows SMB brute-force attacks.

Impact: None; this is the default behavior on current Windows builds.

Checks the minimum Server Message Block dialect the SMB server will negotiate with clients.

This rule fails when lanmanServerMinSmb2Dialect is not SMB_3_1_1.

Rationale: SMB 3.1.1 is the most modern, secure dialect and supports encryption; mandating it blocks older, weaker SMB versions on the server.

Impact: Legacy clients or third-party devices that do not support SMB 3.1.1 will be unable to connect.

Checks whether the SMB server uses the legacy remote mailslots protocol over the computer browser service.

This rule fails when lanmanServerEnableMailslots is not false.

Rationale: Remote mailslots is an old SMBv1-based inter-process communication protocol linked to denial-of-service, buffer-overflow, and remote-code-execution vulnerabilities.

Impact: Any feature relying on remote mailslots on the server will stop functioning.

Checks whether the SMB client logs an event when it connects to a server using the guest account.

This rule fails when lanmanWorkstationAuditInsecureGuestLogon is not true.

Rationale: Insecure guest logons allow unauthenticated access to shares; auditing them on the client surfaces this risky access pattern.

Impact: Each insecure guest logon made by the SMB client is recorded as an audit event.

Checks whether the SMB client logs an event when the SMB server it connects to does not support encryption.

This rule fails when lanmanWorkstationAuditServerDoesNotSupportEncrypt is not true.

Rationale: Visibility into unencrypted SMB server connections helps defenders find legacy servers that expose the environment to interception attacks.

Impact: Each connection to a server that lacks encryption support is recorded as an audit event.

Checks whether the SMB client logs an event when the SMB server it connects to does not support signing.

This rule fails when lanmanWorkstationAuditServerDoesNotSupportSigning is not true.

Rationale: Awareness of unsigned SMB server connections helps identify legacy servers that leave the environment open to interception and tampering attacks.

Impact: Each connection to a server that lacks signing support is recorded as an audit event.

Checks whether the SMB client is prevented from making insecure guest logons to an SMB server.

This rule fails when allowInsecureGuestAuth is not false.

Rationale: Insecure guest logons grant unauthenticated access to shared folders, an easy foothold for an attacker; the client should reject them.

Impact: The SMB client refuses insecure guest logons, matching the modern Windows default.

Checks the minimum Server Message Block dialect the SMB client will negotiate with servers.

This rule fails when lanmanWorkstationMinSmb2Dialect is not SMB_3_1_1.

Rationale: SMB 3.1.1 is the most modern, secure dialect and supports encryption; mandating it blocks older, weaker SMB versions on the client.

Impact: Connections to legacy servers or third-party devices that do not support SMB 3.1.1 will fail.

Checks whether the SMB client uses the legacy remote mailslots protocol over the Multiple UNC Provider (MUP).

This rule fails when lanmanWorkstationEnableMailslots is not false.

Rationale: Remote mailslots is an old SMBv1-based inter-process communication protocol linked to denial-of-service, buffer-overflow, and remote-code-execution vulnerabilities.

Impact: Any feature relying on remote mailslots on the client will stop functioning.

Checks whether the SMB client requires encryption for its connections.

This rule fails when lanmanWorkstationRequireEncryption is not true.

Rationale: Requiring SMB encryption protects file traffic in transit from interception, which older SMB versions cannot provide.

Impact: Connections to servers or devices that do not support SMB encryption (SMB 3.0 or later) may break.

Checks whether the Mapper I/O (LLTDIO) network protocol driver, used to map network topology, is turned off across all network profiles.

This rule fails unless enableLLTDIO, allowLLTDIOOnDomain, allowLLTDIOOnPublicNet, and prohibitLLTDIOOnPrivateNet are all false.

Rationale: Disabling LLTDIO prevents the host from responding to network topology discovery, reducing the risk of discovering and connecting to unauthorized devices.

Impact: Some real-time applications could experience brief network disconnections.

Checks whether the Responder (RSPNDR) network protocol driver, which lets the host be discovered via Link-Layer Topology Discovery, is turned off across all network profiles.

This rule fails unless enableRspndr, allowRspndrOnDomain, allowRspndrOnPublicNet, and prohibitRspndrOnPrivateNet are all false.

Rationale: Disabling the Responder prevents the host from participating in network topology discovery, reducing the risk of discovery and connection by unauthorized devices.

Impact: Some real-time applications could experience brief network disconnections.

Checks whether Microsoft Peer-to-Peer Networking Services, including the Peer Name Resolution Protocol (PNRP), are turned off.

This rule fails when p2PNetworkServicesDisabled is not true.

Rationale: Turning off peer-to-peer networking reduces the overall attack surface associated with distributed name resolution and content distribution protocols.

Impact: All applications that depend on Microsoft peer-to-peer networking will stop working.

Checks whether users are prevented from installing and configuring a Network Bridge.

This rule fails when ncAllowNetBridgeNla is not false.

Rationale: A Network Bridge lets a host join two network segments, allowing traffic to route between internal and external networks and increasing the attack surface.

Impact: Users can no longer create or configure a Network Bridge.

Checks whether users are prevented from enabling Internet Connection Sharing, including the Mobile Hotspot feature.

This rule fails when ncShowSharedAccessUi is not false.

Rationale: Non-administrators should not be able to open the host's Internet connection to nearby mobile devices via Mobile Hotspot.

Impact: Mobile Hotspot cannot be enabled or configured by any user.

Checks whether the NETLOGON and SYSVOL UNC paths require mutual authentication, integrity, and privacy when accessed.

This rule fails unless both hardenedPathsNetlogon and hardenedPathsSysvol require mutual authentication, integrity, and privacy.

Rationale: Hardened UNC paths mitigate the MS15-011 / MSKB 3000483 remote code execution vulnerability in how Group Policy applies data from a domain controller.

Impact: Windows grants access to the specified UNC paths only after the additional security requirements are met.

Checks whether all IPv6 components are disabled by setting the TCPIP6 DisabledComponents parameter to 0xff (255).

This rule fails when disabledComponents is not 255.

Rationale: Most enterprise networks have no need for IPv6; disabling its components removes an attack surface that is harder to monitor and mitigates CVE-2024-38063, a TCP/IP remote code execution vulnerability.

Impact: Connectivity and software that depend on IPv6 (for example Remote Assistance and DirectAccess) will no longer function.

Checks whether access to the Windows Connect Now (WCN) wizards is prohibited.

This rule fails when disableWcnUi is not true.

Rationale: Allowing standard users to reach the WCN wizard increases the attack surface; WCN was not intended for enterprise scenarios.

Impact: The WCN wizards are turned off and users cannot run tasks such as setting up a wireless router or adding a wireless device.

Checks whether Windows Connect Now (WCN) registrars for wireless device discovery and configuration are disabled across all media.

This rule fails unless enableRegistrars, disableUPnPRegistrar, disableInBand802DOT11Registrar, disableFlashConfigRegistrar, and disableWPDRegistrar are all false.

Rationale: WCN was designed for home and small-business networks, not enterprise use; disabling it reduces the risk associated with user configuration of wireless settings.

Impact: Windows Connect Now operations are disabled over all media.

Checks whether Windows prevents establishing a Wi-Fi connection while an Ethernet connection is active.

This rule fails when fMininimizeConnections is not PREVENT_WIFI_CONNECTIONS_WHEN_ON_ETHERNET.

Rationale: Blocking bridged network connections stops a user from unknowingly routing traffic between internal and external networks, which risks exposing sensitive internal data.

Impact: While on Ethernet, Windows will not use a WLAN until Ethernet is disconnected; cellular remains available only for services that require it.

Checks whether Windows is prevented from automatically connecting to suggested open hotspots, networks shared by contacts, and hotspots offering paid services (Wi-Fi Sense).

This rule fails when autoConnectAllowedOEM is not false.

Rationale: Automatically connecting to an open or crowdsourced network can attach the system to a rogue network with malicious intent.

Impact: Users can no longer enable the Wi-Fi Sense automatic-connection features.