Turn off multicast name resolution
This machine-scoped policy setting controls Link-Local Multicast Name Resolution (LLMNR) for the Windows DNS client.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows NT\DNSClient\EnableMulticast
This machine-scoped policy setting controls Link-Local Multicast Name Resolution (LLMNR) for the Windows DNS client. The registry value uses the REG_DWORD type. A value of 0 disables LLMNR on all available network adapters.
LLMNR is a supplementary name-resolution protocol for the local network link. When conventional DNS cannot resolve a name, a client can send a multicast query that other LLMNR-enabled devices on the same subnet may answer. This process does not require a DNS server.
Microsoft documents that LLMNR remains enabled on the available network adapters when the corresponding policy is disabled or not configured.
Notes
Security
Disabling LLMNR prevents the DNS client from issuing LLMNR queries or using LLMNR responses for name resolution. This removes the computer's exposure to LLMNR poisoning, in which a device on the local network supplies a fraudulent response and redirects a connection to an unintended destination. Microsoft specifically identifies disabling LLMNR as protection against tools such as Responder poisoning LLMNR traffic.
This setting does not disable NetBIOS over TCP/IP or Multicast DNS (mDNS). It therefore does not eliminate every local name-resolution mechanism or provide general protection against DNS manipulation, NTLM relay, or other network-based attacks.
Possible side effects
Names that cannot be resolved through DNS or another remaining mechanism, and that previously depended exclusively on LLMNR, might no longer resolve. This can affect applications or devices on local networks that rely on automatic resolution of short names or names that are not registered in DNS.
Notes
The policy name uses negative wording: setting EnableMulticast to 0 represents the enabled policy state and disables LLMNR.
The setting applies to the computer and affects all available network adapters used by the Windows DNS client.
Microsoft documentation
Microsoft Learn: ADMX_DnsClient Policy CSP — Turn_Off_Multicast
Microsoft Learn: Deploy Windows Server 2025 security baselines locally with OSConfig