The broadcast protocols NetBIOS over TCP/IP and LLMNR are used in most modern networks only for compatibility with legacy Windows versions. Both protocols are susceptible to spoofing and MITM attacks. In the Metasploit there are ready-made modules that allow you to easily exploit vulnerabilities in the broadcasting NetBIOS and LLMNR protocols to intercept user credentials in the local network (including NTLMv2 hashes). To improve your network security, you need to disable these protocols on the domain network. Let’s figure out how to disable LLMNR and NetBIOS protocols in Windows 10/Windows Server 2019 manually or through Group Policies.
-
Active DirectoryGroup PoliciesWindows 10Windows Server 2016
Enable Windows Lock Screen after Inactivity via GPO
April 8, 2021In this article we’ll show how to configure automatic screen (session) lock on domain computers or servers using Group Policy. Locking the computer screen when the user is inactive (idle)…
-
PowerShellWindows Server 2016
How to Create and Manage Scheduled Tasks with PowerShell?
April 7, 2021Most users and administrators use the taskschd.msc graphical interface console to create and manage scheduled tasks on Windows. However, in various scripts and automated flows, it is much more convenient…
-
PowerShellVirtualizationVMWareWindows Server 2016
Updating Windows VM Templates on VMWare with PowerShell
April 5, 2021To deploy new virtual machines in VMWare, VM templates are typically used. A VMWare VM template is a reference virtual machine copy with the configured settings, installed software and security…
-
Windows Server 2016Windows Server 2019
Running Multiple IIS Websites on the Same Port or IP Address
April 1, 2021When you install Internet Information Services (IIS) on Windows, an empty “Default Web Site” is created by default and listens on the standard web HTTP port – TCP 80. In…
-
Windows 10Windows Server 2016
Can’t Copy and Paste via Remote Desktop (RDP) Clipboard
March 31, 2021If you are actively using remote connections to your workstations, Windows servers or RDS farms using the RDP protocol, it is likely you have come across a problem when the…
-
Windows 10Windows Server 2016
UAC: This App Has Been Blocked for Your Protection on Windows 10
March 30, 2021Many users have noticed that when running or installing some programs in Windows 10, “This app has been blocked for your protection” error pops up and prevents normal running or…
-
Sometimes when you try to delete, rename or move a file in Windows, you may see a message that the file is busy/locked/used by another process. Usually the name of…
-
Active DirectoryGroup PoliciesWindows Server 2016
Configuring a Domain Password Policy in the Active Directory
March 26, 2021To ensure a high level of security for user accounts in the Active Directory domain, an administrator must configure and implement a domain password policy. The password policy should provide…
-
A new native package manager, WinGet (Windows Package Manager), appeared in Windows 10. You can use it to install apps from the command prompt (like Linux package managers do, for…