Block icmp on domain controllers

Question

Hi,

We are looking into locking down our domain controllers, and was wondering if we could block ICMP. If we block ICMP will that cause any problems with for example communication between domain controllers or between clients and domain controllers ?

I have read something about problems with GPO, but that should not be a problem if we use newer OS version. In the environment there are Windows Server 2008, 2008 R2, 2012, 2012R2, 2016, 2019, Windows 10

Thanks for reply.

/Regards
Andreas

Answer 1

Hello,

Thank you for your question.

Legacy OS 2000,2003, XP were required to open ICMP ports for "Slow network detection"

Vsta, Windows 2008, Win 7, and Windows 2008 no longer rely on ICMP.
Instead they use NLA (Network Location Awareness)

Please have a look on below Microsoft article and Thread discussing the same.

http://technet.microsoft.com/en-us/library/cc725828(WS.10).aspx#BKMK_nla

https://social.technet.microsoft.com/Forums/windowsserver/en-US/f4efdf01-fa0b-43c2-9533-9fe188c4658b/blocking-icmp-can-affect-the-group-policy-implementation?forum=winserverGP

If the reply was helpful, please don’t forget to upvote or accept as answer.