0

"Windows Network and sharing center" allows to see ALL windows OS based devices on a network (and sometimes more).

My inquiry is how this could represent a security risk ? i.e why would a sysadmin would not configure a GPO to disabe it everywhere ?

Is it not harmful ? I'm not an expert but I suppose a malicious user could use it as a footprint tool to scan the network right ?

0

Devices will only show up there if they are configured to be discoverable - for Windows computers machines (7 onwards IIRC) you are asked when first joining a network whether you want to treat it as Private (the computer will be discoverable) or Public (it won't be). See here for more info:

https://www.howtogeek.com/245982/whats-the-difference-between-private-and-public-networks-in-windows/

While it has convenience value for legitimate users looking for devices and resources on the network it really doesn't offer much for a malicious user compared with more dedicated scanning tools. Turning it off to try and protect things is very much security via obscurity IMO - if you've got a discoverable machine called "SuperSecretServer" with an open share called "PlainTextCreditCardDetails" then the fact that it's discoverable is NOT your big problem!

Other devices that show up there are usually doing so because they are UPnP enabled (typically things like printers, media streamers, that kind of thing) where being easily discoverable is often something they aim for.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.