Control 18.6.4.3 misconfigured

[SwaffelSmurf]

Describe the Issue
CIS Control 18.6.4.3 is misconfigured. Multicast name resolution is enabled instead of disabled via the Ansible Lockdown module.

Expected Behavior
According to the GPO description the value of EnableMulticast should be '0':

If you enable this policy setting, LLMNR will be disabled on all available network adapters on the client computer. See admx.help.

Actual Behavior
Ansible Lockdown enables multicast name resolution by setting the value to '1'.

- name: "18.6.4.3 | PATCH | Ensure Turn off multicast name resolution is set to Enabled MS Only | Member Server"
  ansible.windows.win_regedit:
      path: HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient
      name: EnableMulticast
      data: 1
      type: dword

Control(s) Affected
18.6.4.3. (L1) Ensure 'Turn off multicast name resolution' is set to 'Enabled'

Environment (please complete the following information):

• branch being used: devel
• Ansible Version: 2.14.2
• Host Python Version: Python 3.11.5
• Ansible Server Python Version: Python 3.11.5
• Additional Details:

Additional Notes
N/A

Possible Solution
Change the data value:

- name: "18.6.4.3 | PATCH | Ensure Turn off multicast name resolution is set to Enabled MS Only | Member Server"
  ansible.windows.win_regedit:
      path: HKLM:\Software\Policies\Microsoft\Windows NT\DNSClient
      name: EnableMulticast
      data: 0
      type: dword

[frederickw082922]

Good day @SwaffelSmurf

Good catch!

https://admx.help/?Category=Windows_11_2022&Policy=Microsoft.Policies.DNSClient::Turn_Off_Multicast

Thank you!

CC: @MrSteve81