Протокол NetBEUI (NetBIOS Extended User Interface) перестал устанавливаться вместе с Windows начиная с Windows XP. Однако на установочном диске с Windows XP (32-бит, 64-битную версию я не смотрел) необходимый драйвер присутствовал и мог быть установлен отдельно.
На диске с Windows 7 драйвер NetBEUI уже отсутствует (подозреваю, что и с Windows Vista та же история).
Тем не менее драйвер от Windows XP оказывается вполне работоспособным и под Windows 7.
Чтобы его установить делаем следующее:
- находим установочный диск Windows XP;
- заходим в папку VALUEADD\MSFT\NET\NETBEUI;
- файл NBF.SYS копируем в папку WINDOWS\SYSTEM32\DRIVERS\;
- файл NETNBF.INF копируем в папку WINDOWS\INF\;
- в окне свойств подключения нажимаем кнопку Установить…
- в появившемся окне выбираем пункт Протокол и нажимаем кнопку Добавить…
- в окне Выбор сетевого протокола указываем Протокол NetBEUI и нажимаем кнопку OK
В окне Выбор сетевого протокола, как мы видим, есть также кнопка Установить с диска…, позволяющая указать путь к папке, в которой находится драйвер. Однако, после установки протокола таким образом, программа, требовавшая наличия протокола NetBIOS, не заработала.
После установки протокола через предварительное копирование в подпапки Windows программа сразу заработала (при этом в списке протоколов отображалось одновременно два протокола NetBEUI. Лишний я конечно же удалил). Так что в данном случае нужно чётко следовать инструкции, которая, кстати, находится в файле NETBEUI.TXT в папке с драйвером.
NetBIOS Interface.
This service also exists in Windows 10, 11, 8, Vista and XP.
Startup Type
| Windows 7 edition | without SP | SP1 |
|---|---|---|
| Starter | System | System |
| Home Basic | System | System |
| Home Premium | System | System |
| Professional | System | System |
| Ultimate | System | System |
| Enterprise | System | System |
Default Properties
| Display name: | NetBIOS Interface |
| Service name: | NetBIOS |
| Type: | filesys |
| Path: | %WinDir%\system32\DRIVERS\netbios.sys |
| Error control: | normal |
| Group: | NetBIOSGroup |
Default Behavior
The NetBIOS Interface service is a file system driver. If the NetBIOS Interface fails to load or initialize, the error is recorded into the Event Log. Windows 7 startup should proceed, but a message box is displayed informing you that the NetBIOS service has failed to start.
Dependencies
If the NetBIOS Interface is stopped, the Routing and Remote Access fails to start and initialize.
Restore Default Startup Type of NetBIOS Interface
Automated Restore
1. Select your Windows 7 edition and Service Pack, and then click on the Download button below.
2. Save the RestoreNetBIOSInterfaceWindows7.bat file to any folder on your hard drive.
3. Right-click the downloaded batch file and select Run as administrator.
4. Restart the computer to save changes.
Note. Make sure that the netbios.sys file exists in the %WinDir%\system32\DRIVERS folder. If this file is missing you can try to restore it from your Windows 7 installation media.
Yea, though I walk through the valley of the shadow of death, I will fear no evil: for thou art with me; thy rod and thy staff they comfort me.
If you have several computers on your network and would like to see the computers on your network, Enable NetBIOS over TCP/IP to speed this process up. NetBIOS allows computers to be seen by name on your network. Enabling NetBIOS allows your computer to find other computers in your network (Network or Network Places).
To enable NetBIOS over TCP/IP on Windows 7:
- Click Start, and then click Network. (click Start, type ncpa.cpl into the search box for Windows 7 or Vista, hit ENTER).
- Click on the Network and Sharing Center
- Click Manage Network Connections.
- Right click on the Local Area Connection select Properties.
- Select Internet Protocol version 4 (TCP/IPv4)
- Click the Advanced button under the General tab.
- Click the WINS tab.
- Click Enable NetBIOS Over TCP/IP.
- Click OK and Exit the settings.
Connect to older SAMBA servers and older network devices (Article on NTLM)
Cannot access computer by NetBios name after replacing NIC card – See how to clear cache here using NBTSTAT
Disable LLMNR from the command line (Database connections and moving large files across a network)
Improve Your Internet Speed – Read the Article
Are you IPv6 Ready?
Setting up WINS
AMD vs Intel Quad Core Shootout
Want to optimize your computer? See our checklist!
See our review of Windows 8 and see how you can run 90% of your programs, virtualize other operating systems, use your network and more.
Now Tweak your wireless!!
Scan your network with SoftPerfect’s Network Scanner
About TCAT Shelbyville IT Department
The Tennessee College of Applied Technology — is one of 46 institutions in the Tennessee Board of Regents System, the seventh largest system of higher education in the nation. This system comprises six universities, fourteen community colleges, and twenty-six Applied Technology Colleges.
This entry was posted in Computers, Information Technology, network, Wireless and tagged computer repair, Computers, netbios, network, networking, Windows, windows 7, Wireless. Bookmark the permalink.
3. Nblookup
Windows Internet Naming Service (WINS) is a NetBIOS name resolution protocol. WINS performs a function for NetBIOS
names similar to the function that DNS performs for host names. For
many years, WINS name resolution was the most common way for computers
running Windows to identify each other on networks.
However, in Active Directory Domain Services (AD DS) domain
environments, DNS is used by default, and WINS is primarily used to
support older clients and applications.
For environments that still
rely on WINS servers, Nblookup is a valuable tool for diagnosing WINS
name resolution problems. Nblookup is not included with Windows but is
available as a free download from http://support.microsoft.com/kb/830578.
After saving Nblookup.exe to a computer, you can double-click the file
to run it in interactive mode within a command prompt. Alternatively,
command-line mode allows you to run it from any command prompt. The
following examples demonstrate the use of command-line mode.
To look up a NetBIOS name using the computer’s configured WINS server, run the following command.
nblookup computer_name
To look up a NetBIOS name using a specific WINS server, add the /s server_ip parameter, as the following example demonstrates.
nblookup /s server_ip computer_name
For example, to look up the name COMPUTER1 using the WINS server located at 192.168.1.222, you would run the following command.
nblookup /s 192.168.1.222 COMPUTER1
NetBIOS names actually identify services, not computers. If you want to attempt to resolve a NetBIOS name for a specific service, use the /x
parameter and specify the service’s NetBIOS suffix. For example, the
following command would look up domain controllers (which use a NetBIOS
suffix of 1C) in a domain named DOMAIN.
nblookup /x 1C DOMAIN
4. Nbtstat
Nbtstat (Nbtstat.exe)
is a command-line tool for troubleshooting NetBIOS name resolution
problems. NetBIOS is a session-layer protocol that formed the foundation
of Microsoft network applications for several years. NetBIOS
applications identify services on the network by using 16-character
NetBIOS names. Each computer on a network might have several different
NetBIOS names to identify NetBIOS services on that system.
Today, NetBIOS is implemented on TCP/IP networks by using NetBIOS over TCP/IP (NetBT).
NetBT includes its own form of name resolution to resolve NetBIOS names
to IP addresses. Names might be resolved by broadcast queries to the
local network segment or by queries to a WINS server.
Unfortunately, NetBIOS name
resolution is a common source of problems. You can use Nbtstat to reveal
the NetBIOS names available on the local computer or remote computers.
In troubleshooting scenarios, this helps you to verify that a NetBIOS
service is available and its name is being correctly resolved.
To view the NetBIOS name cache, open a command prompt and run the following command.
nbtstat -c
This command produces output similar to the following.
Local Area Connection:
Node IpAddress: [192.168.1.132] Scope Id: []
NetBIOS Remote Cache Name Table
Name Type Host Address Life [sec]
------------------------------------------------------------
WIN71 <00> UNIQUE 192.168.1.196 602
WIN72 <00> UNIQUE 192.168.1.200 585
To view the local NetBIOS service names, open a command prompt and run the following command.
nbtstat -n
This command produces output similar to the following.
Local Area Connection:
Node IpAddress: [192.168.1.132] Scope Id: []
NetBIOS Local Name Table
Name Type Status
---------------------------------------------
WIN71 <00> UNIQUE Registered
HQ <00> GROUP Registered
HQ <1E> GROUP Registered
HQ <1D> UNIQUE Registered
.._MSBROWSE_.<01> GROUP Registered
To view the NetBIOS names on a remote system by using the computer name, open a command prompt and run the following command.
nbtstat -a computername
For example:
nbtstat -a win71
This command produces output similar to the following.
Local Area Connection:
Node IpAddress: [192.168.1.132] Scope Id: []
NetBIOS Remote Machine Name Table
Name Type Status
---------------------------------------------
WIN71 <00> UNIQUE Registered
WIN71 <20> UNIQUE Registered
MSHOME <00> GROUP Registered
MSHOME <1E> GROUP Registered
MAC Address = 00-15-C5-08-82-F3
Notice that the output is similar to the output when running nbtstat –n
locally. However, this output also displays the remote computer’s MAC
address. To view the NetBIOS names on a remote system by using the IP
address, open a command prompt and run the following command.
nbtstat -A IP_Address
Windows 7 (and all recent versions of Windows) prefers to use DNS host names instead of NetBIOS names. Therefore, if you have an AD DS domain with a DNS server configured, you will rarely need to troubleshoot NetBIOS
names. However, Windows might still use NetBIOS names to communicate
with computers on the local network and will use NetBIOS names if a host
name cannot be resolved with DNS and you have configured a WINS server.
5. Net
Net (Net.exe) is a
command-line tool that is useful for changing network configuration
settings, starting and stopping services, and viewing shared resources.
Although other tools provide friendlier interfaces for much of the
functionality provided by Net, Net is very useful for quickly
determining the available shared resources on local or remote computers.
When you are troubleshooting connections to resources, this tool is
useful for verifying that shared resources are available and for
verifying the names of those shared resources.
5.1. How to View Shared Folders on the Local Computer
Use the net share
command to view shared resources located on the local computer. If the
Server service is started, Net will return a list of shared resources
names and locations. To view shared resources, open a command prompt and
run the following command.
net share
This command produces output similar to the following.
Share name Resource Remark
-------------------------------------------------------------------------------
C$ C:\ Default share
D$ D:\ Default share
E$ E:\ Default share
print$ C:\Windows\system32\spool\drivers
Printer Drivers
IPC$ Remote IPC
ADMIN$ C:\Windows Remote Admin
MyShare C:\PortQryUI
HP DeskJet 930C932C935C
LPT1: Spooled HP DeskJet 930C/932C/935C
The command completed successfully.
5.2. How to View Shared Folders on Another Computer
Use the net view
command to view shared resources located on another computer. To view
shared folders on another computer, open a command prompt and run the
following command.
net view computer
For example:
net view d820
This command produces output similar to the following.
Shared resources at d820
Share name Type Used as Comment
-------------------------------------------------------------------------------
In Progress Disk
Printer Print Microsoft Office Document Image Writer
publish Disk
SharedDocs Disk
Software Disk
The command completed successfully.
You can identify Computer
by using the computer name, host name, or IP address. If you receive an
«Access is denied» error message when attempting to view shares on a
remote computer, establish a NetBIOS connection to the remote computer.
For example, you could use Net use to establish a connection and then use Net view, as the following example demonstrates.
net use \\win7 /user:username
net view \\win7
137-139 — NetBIOS
Network Basic Input/Output System (NetBIOS) is a Windows API providing services related to the session layer (layer 5) of the OSI model, mostly for systems on the same link-local subnetwork. NetBIOS runs over TCP/IP via the NetBIOS over TCP/IP (NBT) protocol.
NetBIOS provides notably a name registration and resolution service: the NetBIOS Name Service (NBNS), which operates on UDP port 137 (and may operate on TCP 137). NetBIOS names are 16 ASCII characters in length (with out «\ / : * ? » < > |»), with the 16th character reserved for the resource NetBIOS Suffix. The NetBIOS-NS protocol is used, along (and before) the Link-Local Multicast Name Resolution (LLMNR) protocol, by Windows systems to perform name resolution operation if the Domain Name System (DNS) resolution fails. The name resolution is made through a NBNS Name query NB broadcast request on the link-local broadcast address and can thus only be used to resolve NetBIOS names for hosts on the same subnetwork.
A NetBIOS name table stores the NetBIOS records registered on the Windows system. A record consists of a NetBIOS name, a status, and can be of two type: Unique or Group. Unique record are unique among all systems on the link-local subnetwork and a verification is made by the system registering the NetBIOS name with the Windows Internet Name Service (WINS) server or through a broadcast Registration NB request to ensure that the newly registered name would effectively be unique. For example, such request is made by a Windows system at boot time to register the system NetBIOS hostname in the local-link subnetwork. On the contrary, Group records may take for value a NetBIOS name shared by others systems.
The 16th character of a record NetBIOS name is reserved and corresponds to the NetBIOS Suffix, which indicates the service type associated with the NetBIOS record.
Registered by the Windows Workstation service. Yields for value the system registered NetBIOS hostname.
Registered by the Windows Server service. The Server service supports the sharing of shares and named-pipe over the network.
Domain Master Browser, part of the Browser Service, replaced by Windows Active Directory since Windows XP and only provided for backward compatibility reasons. Registered on the Primary Domain Controller Emulator of the Active Directory domain (only one server acts as the Domain Master Browser across an Active Directory domain).
NetBIOS domain or workgroup name
Master Browser, part of the Browser Service, replaced by Windows Active Directory since Windows XP and only provided for backward compatibility reasons. Only one server acts as the Master Browser in a link-local subnetwork.
NetBIOS domain or workgroup name
Windows Workstation service. Registers the system in a workgroup or Active Directory domain and yields for value the Active Directory domain or workgroup the system is integrated to.
Registered on systems that are Domain Controller in an Active Directory domain.
Additionally, while NetBIOS is completely independent from the Server Message Block (SMB) protocol, SMB does rely on NetBIOS (SMB over NBT, TCP port 139) for communication with systems that do not support direct hosting of SMB over TCP/IP.
nmap can be used to scan the network for exposed NetBIOS services:
nmap -v -sS -sU -sV -sC -p U:137,T:137,138,139 -oA nmap_netbios <RANGE | CIDR>
NetBIOS name resolution and name table enumeration
The Windows nbtstat and the Linux nmblookup utilities can be used to resolve NetBIOS name and retrieve the remote system NetBIOS name table information:
# Linux
# Performs NetBIOS name resolution
nmblookup <NETBIOS_NAME>
# Lists the remote machine's name table given its NetBIOS name / IP address
nmblookup -A <NETBIOS_NAME | IP>
# Windows
# Lists the remote machine's name table given its NetBIOS name / IP address
nbtstat -a <NETBIOS_NAME>
nbtstat -A <IP>If the NetBIOS session service is accessible on the remote system, on TCP port 139, but not the SMB service, SMB over NBT can be used to access remote network shares or execute commands through PsExec-like utilities.
# If no username provided, null session assumed
smbmap -P 139 [-d <DOMAIN>] [-u <USERNAME>] [-p <PASSWORD | HASH>] (-H <HOSTNAME | IP> | --host-file <FILE>)
# TARGETS can be IP(s), range(s), CIDR(s), hostname(s), FQDN(s) or file(s) containing a list of targets
crackmapexec <TARGETS> --port 139 [-M <MODULE> [-o <MODULE_OPTION>]] (-d <DOMAIN> | --local-auth) -u <USERNAME | USERNAMES_FILE> (-p <PASSWORD | PASSWORDS_FILE> | -H <HASH>) [--sam] [-x <COMMAND> | -X <PS_COMMAND>]For more information, refer to the [L7] 445 - SMB and [Windows] Lateral movements notes.
Responses to the broadcasted NBNS name resolution requests can be spoofed, in order to intercept local network traffic. The interception can, notably, be used to capture, and eventually relay, local network SMB authentication requests.
For more information, refer to the [ActiveDirectory] NTLM Relaying note.
https://www.itprotoday.com/compute-engines/knowing-angles-netbios-suffixes https://www.itprotoday.com/compute-engines/what-are-netbios-suffixes-16th-character Network Security Assessment: Know Your Network Windows NT TCP/IP Network Administration