While investigating the demise of NetBIOS and how to fully remove it from a network I came across and interesting observation.
Issuing the commands net config server and net config workstation will show you which protocols are bound for both the serving (Server service) and requesting (Workstation service) of a file over the network.
Look for the section in the output that states “Server is active on” or “Workstation is active on”.
An entry for NetbiosSmb indicates the machines can utilize SMB over TCP (using just port 445). You will probably also see one or more entries that begin with NetBT_Tcpip_{Unique-string}. Each of these entries indicates that SMB over NetBIOS (port 139) is bound to an adapter. These are the entries you seek to make disappear when eradicating NetBIOS from the network.
Indeed, after disabling NetBIOS on my adapter the output looks different.
This is where you may notice something odd if you didn’t already from the screen shots above.
The server service is bound to NetbiosSmb but the workstation service has no bindings at all!
Does this mean I’ve lost my ability to be a client that can request files over direct-hosted SMB using only port 445? Not quite.
It took me a while before I found the answer here
“NetbiosSmb is a global device, and is not bound on a per-adapter basis. This means that direct-hosted SMB’s cannot be disabled in Windows without disabling File and Printer Sharing for Microsoft Networks completely.”
Direct-hosted SMB is alive and well running in the background.
Interestingly enough my testing has shown that going into Advanced Sharing settings of Network and Sharing Center and toggling the radio button for “Turn off file and printer sharing” does not achieve the desired outcome on a server. To truly disable the serving of files you must go into the adapter properties and uncheck “File and Printer Sharing for Microsoft Networks” and then reboot. This effectively disables the serving of files, although net config server still shows NetbiosSmb as being active. Uninstalling File and Printer Sharing for Microsoft Networks from the sole network adapter in my system also does not cause NetbiosSmb to disappear.
Going into “Remove Roles and Features” and removing the File Server feature of File and Storage Services does remove the NetbiosSmb binding from the server service, but only after a reboot.
Short of modifying the registry I don’t know of a way to disable this client-side, but I also can’t think of a reason why that would be necessary.