How to Disable Network Discovery to Hide Devices Using Group Policy in Windows Server 2025

In a Windows Server 2025 Active Directory environment, administrators may want to prevent domain computers from appearing in the Network section of Windows File Explorer. Reducing unnecessary network visibility can simplify network browsing and support a defense-in-depth security strategy.

Windows provides several mechanisms for managing network discovery, including Group Policy, Windows Defender Firewall, Link-Layer Topology Discovery (LLTD), and Function Discovery services.

In this tutorial, you will learn how to create a dedicated Group Policy Object (GPO), configure discovery-related settings, apply the policy to domain computers, verify the results, and troubleshoot common problems.

1. What Is Network Discovery in Windows?

Network Discovery allows Windows devices to discover other devices and resources on a local network. Depending on the available discovery protocols, network profile, and firewall configuration, users may see computers, printers, and other discoverable devices under File Explorer > Network.

Each component has a different role. Disabling one service or protocol does not necessarily disable every form of network discovery or make the computer unreachable.

2. Prerequisites

Before configuring the policy, make sure you have:

• A functioning Active Directory domain.
• Windows Server 2025 or a supported Windows Server management environment.
• Group Policy Management Console (GPMC).
• Permission to create, edit, and link GPOs.
• A test Organizational Unit (OU) containing test computer accounts.
• A rollback plan for discovery-dependent applications and network services.

Test the configuration on a small group of computers before applying it to production workstations, servers, or the entire domain.

3. Open Group Policy Management

Sign in to a domain management computer or server using an account authorized to manage Group Policy.

Press Windows + R, enter the following command, and press Enter:

gpmc.msc

In Group Policy Management:

1. Expand Forest.
2. Expand your domain.
3. Locate the OU containing the computers you want to manage.

If GPMC is not installed, add the Group Policy Management feature through Server Manager or install the appropriate Remote Server Administration Tools.

4. Create a Dedicated Group Policy Object

A dedicated GPO keeps discovery-related configuration separate from unrelated security and desktop policies.

1. In Group Policy Management, right-click Group Policy Objects.
2. Select New.
3. Enter the name Disable Network Discovery – Windows Server 2025.
4. Click OK.
5. Right-click the new GPO and select Edit.

5. Configure Link-Layer Topology Discovery Policies

Windows includes Administrative Template policies for Link-Layer Topology Discovery (LLTD). These settings control specific topology discovery drivers, rather than every Windows discovery mechanism.

In Group Policy Management Editor, navigate to:

Computer Configuration
  > Policies
    > Administrative Templates
      > Network
        > Link-Layer Topology Discovery

5.1 Disable the Mapper I/O (LLTDIO) driver

1. Open Turn on Mapper I/O (LLTDIO) driver.
2. Select Disabled.
3. Click Apply, then OK.

This prevents the LLTD Mapper I/O driver from being enabled through this policy.

5.2 Disable the Responder (RSPNDR) driver

1. Open Turn on Responder (RSPNDR) driver.
2. Select Disabled.
3. Click Apply, then OK.

This prevents the LLTD Responder driver from being enabled through this policy.

6. Configure Windows Defender Firewall Rules

Windows Defender Firewall can restrict inbound network discovery traffic. The appropriate configuration depends on the discovery protocols and network profiles used in your environment.

6.1 Inspect the existing discovery firewall rules

On a test computer, open PowerShell as an administrator and run:

Get-NetFirewallRule -DisplayGroup "Network Discovery" |
    Select-Object DisplayName, Enabled, Direction, Action, Profile

Review the enabled rules, actions, directions, and profiles before making changes. The display-group name may be localized on some Windows installations.

6.2 Configure firewall policy centrally

1. Open your GPO in Group Policy Management Editor.
2. Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Windows Defender Firewall with Advanced Security.
3. Select Inbound Rules.
4. Create or configure rules for the specific discovery traffic you need to block.
5. Choose the appropriate action, protocol, ports, and network profiles.
6. Apply the rules to the intended target computers and validate the effective configuration.

You can use predefined Network Discovery rule groups where appropriate, but review the individual rules and resulting actions. Do not assume that every predefined rule group can be switched to Block as a single group action.

6.3 Optional PowerShell test on a local computer

The following command enables the matching local rules and sets their action to Block. Use it only on a controlled test computer. It modifies local firewall rules rather than creating a domain GPO.

Get-NetFirewallRule -DisplayGroup "Network Discovery" |
    Set-NetFirewallRule -Enabled True -Action Block

7. Optionally Manage Function Discovery Services

If your goal is to stop a computer from advertising itself through Function Discovery Resource Publication, you can consider managing the corresponding service through Group Policy.

In Group Policy Management Editor, navigate to:

Computer Configuration
  > Policies
    > Windows Settings
      > Security Settings
        > System Services

1. Locate Function Discovery Resource Publication.
2. Open its properties.
3. Select Define this policy setting.
4. If appropriate for your environment, configure the startup mode as Disabled.
5. Apply the policy and close the editor.

Disabling this service may reduce publication through that mechanism. It does not guarantee that every discovery method will stop.

The Function Discovery Provider Host service (fdPHost) has a different role. Do not disable it automatically unless your requirements justify doing so and you have tested the consequences.

Inspect discovery-related services

Get-Service -Name fdPHost, FDResPub, SSDPSRV, upnphost |
    Select-Object Name, Status, StartType

This read-only command shows service states and startup types. It does not independently prove that all network discovery protocols have been disabled.

8. Link the GPO to the Target Organizational Unit

After configuring the policy, link it to the OU containing the intended computer accounts.

1. Return to Group Policy Management.
2. Locate the target OU.
3. Right-click the OU.
4. Select Link an Existing GPO.
5. Select Disable Network Discovery – Windows Server 2025.
6. Click OK.

Verify the GPO’s security filtering, permissions, inheritance, and scope. Computer Configuration settings must reach the computer accounts they are intended to manage.

9. Apply Group Policy on a Domain Computer

On a target domain computer, open Command Prompt as an administrator and execute:

gpupdate /force

Wait for Group Policy processing to finish. Restart the test computer during an approved maintenance window if a particular setting requires a restart.

Check applied policies

gpresult /r

For a detailed HTML report, run:

gpresult /h C:\Temp\GroupPolicyReport.html

Ensure that C:\Temp exists before generating the report. Open the report and confirm that the new GPO appears in the applied computer policies.

10. Verify Network Discovery Behavior

10.1 Check File Explorer

1. Open File Explorer on another computer on the same network.
2. Select Network in the navigation pane.
3. Check whether the target computer appears.
4. Allow time for discovery changes and cached browsing results to update.
5. Repeat the test from another authorized client if necessary.

A computer disappearing from File Explorer does not prove that it is unreachable. Network browsing depends on caching, firewall configuration, network profiles, and the discovery protocols in use.

10.2 Inspect firewall rules

Get-NetFirewallRule -DisplayGroup "Network Discovery" |
    Select-Object DisplayName, Enabled, Direction, Action, Profile

Confirm that the relevant rules have the intended actions, enabled states, and profiles. Where domain policy is involved, check the effective configuration rather than relying only on local settings.

10.3 Inspect discovery services

Get-Service -Name fdPHost, FDResPub, SSDPSRV, upnphost |
    Select-Object Name, Status, StartType

Compare the results with your intended configuration and investigate unexpected service states.

10.4 Test connectivity separately

To determine whether a target accepts TCP connections on a particular port, run this command from an authorized test computer:

Test-NetConnection -ComputerName 192.168.1.20 -Port 445

Replace 192.168.1.20 with the target computer’s IP address. TCP port 445 is commonly used for SMB file sharing.

A successful test indicates that the tested TCP port is reachable. A failed test does not prove that the computer is invisible or that all network access is blocked.

11. Troubleshooting Common Problems

The computer still appears in File Explorer

• Confirm that the GPO applies to the target computer account.
• Review effective firewall rules and network profiles.
• Check for other discovery mechanisms that may still advertise the computer.
• Allow time for cached network browsing results to update.
• Review conflicting GPOs and local configuration.

The GPO is not being applied

Run these commands on the target computer:

gpupdate /force
gpresult /r

Review the computer’s OU, security filtering, permissions, inheritance, and applied policy list.

Shared folders or printers stop working

Network Discovery and file sharing are separate capabilities, but related firewall or service changes can affect legitimate workflows. Test SMB access, printers, backup systems, and remote administration after each change. Adjust the specific rule or service responsible for the issue rather than disabling the firewall entirely.

The computer is still reachable by IP address

This is expected. Network discovery controls mechanisms used to find or advertise devices; it is not a network isolation feature. To restrict access, implement appropriate firewall rules, network segmentation, and resource permissions.

12. Roll Back the Configuration

If the changes cause unexpected problems, use a controlled rollback procedure.

1. Open Group Policy Management.
2. Edit the GPO created for this purpose.
3. Restore the original LLTD policy settings.
4. Remove or modify the firewall rules introduced for the change.
5. Restore service startup settings if they were changed.
6. Run gpupdate /force on a test computer.
7. Verify network discovery and required network access again.

If the GPO was created exclusively for this purpose, unlinking or disabling it may also be appropriate. Verify the effective configuration afterward because other GPOs and local settings may continue to apply.

13. Enterprise Best Practices

• Test first: Use a pilot OU before a broad rollout.
• Keep policies separate: Avoid mixing discovery settings with unrelated security baselines.
• Preserve connectivity: Validate printers, file servers, backup systems, and remote administration.
• Use least privilege: Restrict access to shared resources through permissions and authentication.
• Configure firewalls deliberately: Scope rules to the required traffic and network profiles.
• Use network segmentation: Isolate sensitive systems where required.
• Document exceptions: Record workloads that legitimately depend on discovery.
• Review periodically: Recheck effective policies as the environment changes.

14. Frequently Asked Questions

Related Tutorial

If you also want to manage the Windows desktop experience across domain computers, read our related Windows Server 2025 Group Policy guide.

Conclusion

Disabling Network Discovery-related functionality through Group Policy on Windows Server 2025 can reduce unnecessary device visibility in Windows network browsing. LLTD policy settings, carefully scoped firewall rules, and optional Function Discovery service configuration can help administrators manage how domain computers participate in network discovery.

Test every change, verify the effective policy, and preserve the network services required by your organization. For stronger protection, combine discovery restrictions with firewall access controls, network segmentation, and least-privilege permissions.

15. References and Authoritative Sources

1. Microsoft Support: File sharing over a network in Windows
2. Microsoft Learn: Security guidelines for disabling system services in Windows Server
3. Microsoft Learn: Troubleshoot Network Discovery in Windows
4. Microsoft Download Center: Group Policy Settings Reference

Technical note: Verify that the documentation and instructions apply to the Windows versions and administrative interfaces used in your environment.