How to Completely Disable ‘Network Discovery’ via Group Policy in Windows 11

Network Discovery is a Windows feature that utilizes protocols like LLMNR, SSDP, and NetBIOS over TCP/IP to broadcast a machine’s presence on a local network and listen for other devices (like printers, file shares, and other PCs). While incredibly useful for a home user trying to find a wireless printer, it represents a significant security vulnerability in a corporate environment. If a Windows 11 endpoint is compromised, active Network Discovery allows malware (like worms or ransomware) to easily enumerate the local subnet, discover other vulnerable targets, and spread laterally. In strict Zero Trust environments, endpoints should only communicate with explicitly defined servers, not blindly broadcast their presence to peers.

This guide explains how to completely disable Network Discovery system-wide using the Group Policy Editor in Windows 11.

Disable Network Discovery via Group Policy

To enforce a strict block that prevents the OS from participating in local network enumeration and locks the setting so users cannot accidentally re-enable it in the Control Panel, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Network > Link-Layer Topology Discovery

5. You must configure two separate policies here to ensure complete lockdown:
   • Double-click Turn on Mapper I/O (LLTDIO) driver. Select Disabled. Click Apply and OK.
   • Double-click Turn on Responder (RSPNDR) driver. Select Disabled. Click Apply and OK.
6. Optional but recommended: To ensure the UI reflects this and prevents users from tweaking advanced sharing settings, you can also navigate to Computer Configuration > Windows Settings > Security Settings > Windows Defender Firewall with Advanced Security and enforce a block on inbound/outbound rules for the “Network Discovery” predefined group.

Verify the Network Lockdown

To enforce the change immediately across the system, open an elevated Command Prompt and execute gpupdate /force.

To verify the restriction is active, open the Windows File Explorer and click on “Network” in the left-hand pane. A yellow banner will appear at the top stating that “Network discovery is turned off.” If you attempt to click the banner to turn it on, the action will fail or be blocked by policy. Furthermore, running a packet capture (like Wireshark) on the endpoint will show a drastic reduction in local subnet broadcast chatter (specifically SSDP on port 1900 and LLMNR on port 5355). You have successfully mitigated a primary vector for lateral network movement.