Windows Server 2025 must be configured to ignore NetBIOS name release requests except from WINS servers.

Configuring the system to ignore name release requests, except from WINS servers, prevents a denial-of-service (DoS) attack. The DoS consists of sending a NetBIOS name release request to the server for each entry in the server's cache, causing a response delay in the normal operation of the server's WINS resolution capability.

If the following registry value does not exist or is not configured as specified, this is a finding:

Registry HiveHKEY_LOCAL_MACHINE Registry Path\SYSTEM\CurrentControlSet\Services\Netbt\Parameters\

Value NameNoNameReleaseOnDemand

Value TypeREG_DWORD Value0x00000001 (1)

Configure the policy value for Computer Configuration >> Administrative Templates >> MSS (Legacy) >> MSS: (NoNameReleaseOnDemand) Allow the computer to ignore NetBIOS name release requests except from WINS servers to "Enabled".

This policy setting requires the installation of the MSS-Legacy custom templates included with the STIG package. "MSS-Legacy.admx" and "MSS-Legacy.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.