PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Disable WPAD via GPO

projectblack.io | research | #windows | #proxy | #hardening | #mitm | #gpo | #wpad
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Most public guides to disabling WPAD, including Microsoft's, are incorrect; after the author reported this to MSRC, Microsoft updated its documentation. Covers the two registry keys and GPOs needed.
Published
Collected

Related coverage

blog · semperis.com
AD Security 101: Lock Down Risky User Rights
User rights assigned via GPOs—debug programs, back up files, take ownership, and more—become risky when misassigned. Explains how to review and lock down dangerous user rights in Active Directory.
blog · semperis.com
AD Security 101: GPO Logon Script Security
GPO logon scripts automate logon tasks, but sprawling, poorly maintained GPO structures invite abuse. Covers how scripts work (scripts.ini) and how to secure them.
blog · semperis.com
AD Security 101: Domain Controller Security
DC security essentials: promotion changes a server's logon model and access must be tightly restricted. GPOs linked to the Domain Controllers OU affect all DCs, so mistakes are high-impact.
blog · netspi.com
ADIDNS Revisited – WPAD, GQBL, and More
Kevin Robertson expands on ADIDNS attacks, covering why WPAD records fail against the global query block list and demonstrating GQBL bypasses with wildcard, DNAME, and NS records.
research · projectblack.io
Password Policy GPO
After cracking ~40% of passwords in AD environments, the post recommends disabling forced expiry (max age 0), raising minimum length toward 16, and passphrase training — cutting crack rates to ~5%.
research · projectblack.io
Disable TLS 1.0 and 1.1 via GPO
Disabling TLS 1.0/1.1 (and Triple DES) on Windows via GPO: set the SCHANNEL protocol Enabled DWORDs to 0. The post notes this is server-side only and doesn't restrict outbound client connections.
Back