Microsoft Windows 10

The system must be configured to ignore NetBIOS name release requests except from WINS servers

STIG ID: WN10-CC-000035 | SRG: SRG-OS-000420-GPOS-00186 | Severity: Low | CCI: CCI-002385 | Vulnerability ID: V-220798

Description

Configuring the system to ignore name release requests, except from WINS servers, prevents a denial of service (DoS) attack. The DoS consists of sending a NetBIOS name release request to the server for each entry in the server's cache, causing a response delay in the normal operation of the servers WINS resolution capability.

Check

C-220798r958902_chk

If the following registry value does not exist or is not configured as specified, this is a finding:Registry Hive: HKEY_LOCAL_MACHINERegistry Path: \SYSTEM\CurrentControlSet\Services\Netbt\Parameters\Value Name: NoNameReleaseOnDemandValue Type: REG_DWORDValue: 1

Fix

F-22502r554880_fix

Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> "MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers" to "Enabled".This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and " MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.