We had a pentration test in our company. One of the recommendations was to disable WPAD (Windows Proxy Auto Discovery), LLMNR, NetBIOS.
We have successfully disabled LLMNR by GPO, NetBIOS on DHCP as well as on the station using PS script. However little problem is with WPAD.
Our administrators disabled by GPO these items:
Windows Settings |- Internet Explorer Maintenance |- Connection/Automatic Browser Configuration |- Automatically detect configuration settings - Disabled |- Administrative Templates |- Windows Components / Internet Explorer |- Disable caching of Auto-Proxy scripts - Enabled |- Disable changing Automatic Configuration settings - Enabled
I have found some instructions on how to check if WPAD is turned off. One of them was to check if this service is running:
sc query winhttpautoproxysvc
I have also found information, it is enough to turn off LLMNR and NetBIOS, because it is a prerequisite for WPAD attack, but I am not sure about this.
Next, I have found information, the only possibility how to prevent WPAD attack, is to set DNS for wpad query to 127.0.0.1.
So my questions are:
- Are the settings in GPO above enough to prevent WPAD attacks?
- If No, what is the best way (setting) to prevent this attack?
- To prevent WPAD attack, it is enough to turn off LLMNR and NetBIOS?