Check if Netbios is disabled over TCP/IP

[C0rocad]

Hi all,

Company recently requested we disable Netbios on all of our workstations, around 100 machines. Doing so was easy enough over Lansweeper using a command to disable it.

My concern now is I'd like to generate a report of all the machines and the status of Netbios on it so I can show the higher ups it has been done.

This is all very new to me so any help would be appreciated!

[CyberCitizen]

Doesn't look like a real easy way to report on as it depends on the amount of interfaces and new interfaces can be added.

You could perhaps create a deployment package and script that queries the keys and write to a file, not ideal.

I did find this which I thought was useful.

The default setting is to obtain NetBIOS settings from your DHCP server, so you can disable it there and it will cover 99% of cases (unless a user explicitly turned it on).

Another option would be to use GPO to set the NetBIOS firewall rules to Block traffic.

For workstations we deployed a GPO that blocked outbound 137/139 UDP which effectively stops Responder attacks without having to deal with turning off netbios. Now on all new machine netbios is disabled in the image, but the GPO firewall rule was a lot quicker than relying on touching every interface.

https://support.managed.com/kb/a545/testing-and-disabling-netbios.aspx

[Wesker305]

Anyone find a way to generate this report,we are looking for the same.

Thanks!

[TaherMD]

C0rocad wrote:
Hi all,

Company recently requested we disable Netbios on all of our workstations, around 100 machines. Doing so was easy enough over Lansweeper using a command to disable it.

My concern now is I'd like to generate a report of all the machines and the status of Netbios on it so I can show the higher ups it has been done.

This is all very new to me so any help would be appreciated!

Hi C0rocad,

could you share the command line used?

Thanks