Windows Defender Firewall: Prohibit unicast response to multicast or broadcast requests
Verified with Windows 11 25H2 — updated on July 10, 2026
Supported on: At least Windows XP Professional with SP2
Path in the GPO console
Computer Configuration\Administrative Templates\Network\Network Connections\Windows Defender Firewall\Domain Profile Description
Prevents this computer from receiving unicast responses to its outgoing multicast or broadcast messages. If you enable this policy setting, and this computer sends multicast or broadcast messages to other computers, Windows Defender Firewall blocks the unicast responses sent by those other computers. If you disable or do not configure this policy setting, and this computer sends a multicast or broadcast message to other computers, Windows Defender Firewall waits as long as three seconds for unicast responses from the other computers and then blocks all later responses. Note: This policy setting has no effect if the unicast message is a response to a Dynamic Host Configuration Protocol (DHCP) broadcast message sent by this computer. Windows Defender Firewall always permits those DHCP unicast responses. However, this policy setting can interfere with the NetBIOS messages that detect name conflicts.
Registry
SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile Value name: DisableUnicastResponsesToMulticastBroadcast
Enabled: DisableUnicastResponsesToMulticastBroadcast = 1
Disabled: DisableUnicastResponsesToMulticastBroadcast = 0
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Windows Defender Firewall: Prohibit unicast response to multicast or broadcast requests
; State: Enabled
; Supported on: At least Windows XP Professional with SP2
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
"DisableUnicastResponsesToMulticastBroadcast"=dword:00000001More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Windows Defender Firewall: Prohibit unicast response to multicast or broadcast requests
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableUnicastResponsesToMulticastBroadcast' -Value 1 -Type DWordIntune XML
No direct Policy CSP / OMA-URI mapping for this policy. Use the Intune Remediation tab, or ingest the ADMX in Intune.Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Windows Defender Firewall: Prohibit unicast response to multicast or broadcast requests
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile' -Name 'DisableUnicastResponsesToMulticastBroadcast' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Windows Defender Firewall: Prohibit unicast response to multicast or broadcast requests
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableUnicastResponsesToMulticastBroadcast' -Value 1 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Windows Defender Firewall: Prohibit unicast response to multicast or broadcast requests
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Windows Defender Firewall: Prohibit unicast response to multicast or broadcast requests
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile' -Name 'DisableUnicastResponsesToMulticastBroadcast' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Windows Defender Firewall: Prohibit unicast response to multicast or broadcast requests
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableUnicastResponsesToMulticastBroadcast' -Value 1 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.