Questions[netbios](server)

Can someone explain when and how often each of the Windows RPC ports are used? The "core" ones I understand are:

• Port 135
• Port 137
• Port 139
• Higher ports that are published by Port 135's "catalog"

Then I heard that Port 145 came into the mix to "make things better" with NBT/TCP but I'm not sure how this fits in with the sequence of a Windows client initiating an RPC action.

Can anyone help me fix my understanding of RPC ports once and for all?

We are a development shop where all 50-odd workstation computers run Windows 7 SP1 and most of our 20-30 servers are Server 2008 R2 or Server 2008 (there are a few scragglers still on Server 2003). We have a flat, single subnet environment where servers and workstations are in the same network. We have DNS servers with dynamic DNS registration enabled and currently we have WINS servers too. In performing some diagnostic Wireshark packet capturing on our network for an different issue, we've seen that there is quite a lot of NetBIOS broadcast noise on our network.

We are looking to disable NetBIOS broadcast by changing the node type of our workstations (and possibly servers) to p-node (or peer only) where WINS will be used as the only name resolution method. We will most likely configure it via the 043 DHCP option to ensure that even non-domain joined clients participate on our network without broadcast. We considered using the Group Policy approach to roll-out the registry key, but this may have detrimental effects on our laptop users when offsite (such as on their home networks).

Here are my questions:

• will this cause issue with any of the few Windows Server 2003 servers we have left, or for any of our Windows 7 clients or other newer Windows servers?
• Further to that, is it even advisable to prevent NetBIOS broadcast or should the noise just be ignored as a typical part of the network?
• We've also considered disabling NetBIOS completely. However, the only way I know of doing so is to disable NetBIOS of TCP/IP. I assume this is the only NetBIOS method left in Windows 7? So disabling this on the NIC (or for the whole PC) disables NetBIOS completely?
• Will disabling NetBIOS mean that the FQDN/long name (eg, companyname.tld) of the domain need to be used for logon purposes due to the short-name (eg, COMPANYNAME) no longer being available? (ie, [email protected] has to be used instead of COMPANYNAME\username) If this is the case, will Windows still show Logon to: COMPANYNAME or will it show Logon to: companyname.tld.

In summary, we're after some guidance on what is common practice for organisations to do with NetBIOS communications these days and the experiences of others when making changes to NetBIOS network configuration similar to my topology.

I've found the below topic which links to a few others, but I'm still not convinced. I'd like to know the steps people took to 'disabling' or limiting NetBIOS and any shortcomings or advantages of doing so.

NetBIOS "free" network?

Edit:

As per questions; running Active Directory, functionality level 2008, prepped for 2008 R2, soon to be R2 functionality.

And I received a decent "why" question, to which I said:

I'm of the opinion that if it isn't needed, it shouldn't be on. Plus, there is a lot of noise on the network from broadcast resolutions - sure these packets are tiny, but I just was after some clarity on what others (perhaps in bigger organisations) have done regarding NetBIOS.

When you name your Windows computers and Im talking from Windows 2000 to Win7 do you stay within the Netbios name limit for workstations of 15 charactors? I interested if this limit is still relevant in a corporate network wether users login to a domain or the local workstation.

I was wondering if someone here has had an enterprise experience running a "NetBIOS-free" network. I have in mind a mid to big Windows-based network.

I found some good posts here, here and here.

I would like to know if someone actually works (or worked) in a company that completely disabled NetBIOS? Was this scenario achieved painlessly?

What motivated me to ask this is that when I run certain tools to identify security problems in my network, most of them are related to NetBIOS. Of course I could try to do hardening, but since NetBIOS seems to be deprecated, why not completely turn it off?

What process is necessary to configure a Windows environment to allow me to use DNS CNAME to reference servers?

I want to do this so that I can name my servers something like SRV001, but still have \\file point to that server, so when SRV002 replaces it I don't have to update any of the links people have, just update the DNS CNAME and everyone will get pointed to the new server.