Should you kill NetBIOS from your network?

In a Windows XP network, NetBIOS is on by default. There are some misconceptions regarding whether NetBIOS is required in order to have file sharing working. In fact, that is not the case. This post will explain what I found out when investigating the impact of removing NetBIOS from our corporate network.

Do you still have NetBIOS turned on on all of your workstations and servers in your corporate LAN?  This old network protocol puts you at risk and should be killed without prejudice!

There are quite a few reasons why NetBIOS is bad for your network.

  1. NetBIOS is an inneficient protocol.  It is very chatty with lots of broadcasts.
  2. When used with its defaults settings, it can be used by the bad guys to gather information about your network and users.  This is done through null sessions.  An excellent source of information on null session can be found in the (old, but still true) page titled NetBIOS Null Sessions: The Good, The Bad, and The Ugly.
  3. Although it can now be routed across LANs by using NetBIOS over TCP/IP (NetBT), it was never meant to be used in a WAN environment.
  4. The original design of NetBIOS was actually for a LAN of about 70 users.

One of the major misconception about NetBIOS is the fact that people think that it has to be there in order for you to have a file share to serve files to your network users.  That is actually not the case.

File sharing on your LAN

NetBIOS uses these ports:

  • UDP 137: NetBIOS name service
  • UDP 138: NetBIOS datagram service
  • TCP 139: NetBIOS session service

In actual fact, a workstation that tries to connect to a file share might start by trying using those ports.  Windows will automatically fall back to using SMB, which is on port TCP 445.  You might have heard of SMB (Server Message Blocks) and CIFS (Common Internet File System) in the same conversation.  That’s because CIFS is actually a dialect of SMB.

The downside of disabling NetBIOS

I found only two problems that you might run into if you disable NetBIOS.  Another side effect is that this will affect trusts between forests.  This is definitely true for domains at the Windows 2000 functional level or even a Windows NT to Windows 2003 trust.  In a simpler network with only one domain in your forest, this will not be an issue.

The other negative impact that I found is the fact that you no longer browse for computer in Network Neighborhood (Windows 98) or Microsoft Windows Network (Windows XP). When NetBIOS is enabled in your network, the master browser collects information about all the computers in the network.  That information is then propagated every 12 minutes to all workstations.  This can be displayed in the network neighborhood or using the NET VIEW command.  In effect, this is how name resolution was done, by using the list maintained by the master browser. WINS is the other name resolution method in the NetBIOS world.  This method is no longer used by Microsoft OS since Windows 2000.

How to deal with NetBIOS

The best thing to do, is simply to eliminate NetBIOS.  You probably won’t miss it.  Most likely, if your network has more than a few computers in it, you are using DHCP.  You can use DHCP to easily disable NetBIOS on your workstations.  In a smaller setting, you can change the configuration on each computer in your network by doing the following (instructions for Windows XP):

  1. Click Start, point to Settings, and then click Network and Dial-up Connection.
  2. Right-click Local Area Connection, and then click Properties.
  3. Click Internet Protocol (TCP/IP), and then click Properties.
  4. Click Advanced.
  5. Click the WINS tab, and then click Disable NetBIOS over TCP/IP.

This method disables NetBIOS Session Service (which listens on TCP port 139). It does not disable NetBIOS completely.  If you do not want to have SMB enabled, you can disable it all at once by using the following instructions:

  1. From the Start menu, right-click My Computer, and then click Manage.
  2. Expand System Tools, and then clear the Device Manager check box.
  3. Right-click Device Manager, point to View, and then select Show hidden devices.
  4. Expand Non-Plug and Play Drivers.
  5. Right-click NetBios over TCP/IP, and then click Disable.

This disables the SMB direct host listener on TCP/445 and UDP 445.

Final Thoughts

Before you make such an important change in your network, you need to do some serious testing.  This is especially true if you have a lot of different servers and applications.  I intend to post again with the result of my testing and the effect that disabling NetBIOS had on our network.

Related links

One thought on “Should you kill NetBIOS from your network?”

  1. Hi, great article. Have you posted the results of the removal and your findings during testing? Very interested as I am on a project that involves this and I am new to this topic.

Comments are closed.