Fully disabling Network Discovery in Windows 10 using Group Policy

To properly disable Network Discovery in Windows 10 in a way that the user cannot easily re-enable we must create some firewall rules and prevent some services from running on start-up. We can do both things using Group Policy.

Firewall Rules

Create a new Group Policy or use an existing one that takes effect on computer objects.

1. Go to Computer Configuration > Policies > Windows Settings > Security Settings > Windows Firewall with Advanced Security.
2. Inside the Inbound Rules node, right click and choose New Rule.
3. On Rule Type, select Predefined and choose Network Discovery then click Next.
4. You will be presented with a long list of rules, many of which are duplicates because of the Profile they belong to; Public, Domain, Private.
5. Select only the following rules, it does not matter which profile as we will change it later.
   • Network Discovery (LLMNR-UDP-In)
   • Network Discovery (NB-Datagram-In)
   • Network Discovery (NB-Name-In)
   • Network Discovery (Pub-WSD-In)
   • Network Discovery (SSDP-In)
6. Next, choose Block the connection and click Finish.
7. We will now make some changes to those rules.
8. First, select Network Discovery (NB-Datagram-In) and go to its properties.
9. On the General tab, select the Allow the connection radio button.
10. Next on the Scope tab, under Remote IP address, select the These IP addresses: radio button and then click Add…
11. In the new window, select the Predefined set of computers: radio button and choose Local subnet from the drop-down list.
12. Next on the Advanced tab, make sure that the check boxes next to Domain, Private and Public are all checked.
13. Click on Apply, and close the properties window.
14. On the other 4 inbound rules repeat steps 10 - 13.

Your inbound firewall rules should look like this:

We are now going to repeat the steps above for the outbound rules.

1. Inside the Outbound Rules node, right click and choose New Rule.
2. On Rule Type, select Predefined and choose Network Discovery then click Next.
3. You will be presented with a long list of rules, many of which are duplicates because some the Profile they belong to eg. Public, Domain, Private.
4. Select only the following rules, it does not matter which profile as we will change it later.
   • Network Discovery (LLMNR-UDP-Out)
   • Network Discovery (NB-Datagram-Out)
   • Network Discovery (NB-Name-Out)
   • Network Discovery (Pub-WSD-Out)
   • Network Discovery (SSDP-Out)
5. Next, choose Block the connection and click Finish.
6. We will now make some changes to those rules.
7. First, select Network Discovery (NB-Datagram-Out) and go to its properties.
8. On the General tab, select the Allow the connection radio button.
9. Next on the Scope tab, under Remote IP address, select the These IP addresses: radio button and then click Add…
10. In the new window, select the Predefined set of computers: radio button and choose Local subnet from the drop-down list.
11. Next on the Advanced tab, make sure that the check boxes next to Domain, Private and Public are all checked.
12. Click on Apply, and close the properties window.
13. On the other 4 inbound rules repeat steps 9 - 12.

Your outbound firewall rules should look like this:

System Services

Now we are going to configure the Group Policy to disable some system services.

1. Go to Computer Configuration > Policies > Windows Settings > Security Settings > System Services.
2. Select the Function Discovery Provider Host service and go to it properties page.
3. Select Define this policy setting, choose Disabled and then click on Apply and close the properties window.
4. Repeat the above steps for the following services:

• Function Discovery Resource Publication
• Link-Layer Topology Discovery Mapper
• SSDP Discovery
• UPnP Device Host

The Group Policy is now configured. Link it to an OU or OU’s that contain computer objects and run gpupdate or restart the computers. Network Discovery will now be disabled and even if a user enabled it in the Network and Sharing Center it will remain disabled.

Support My Work

If you would like to support me, please check out the link below.

• PayPal

If you have any questions or comments please leave them below.

-Mike