Key Points
Introduction: Explains why keeping NetBIOS over TCP/IP enabled increases your attack surface and when disabling it is recommended for security hardening.
What is NetBIOS over TCP/IP: Describes what NetBIOS over TCP/IP is used for, why it is considered a legacy protocol, and how leaving it enabled can expose services that aid discovery and lateral movement.
Quick setup: Shows how to detect the “NetBIOS over TCP/IP is not disabled” misconfiguration in Vulnerability Manager Plus and provides the exact Windows steps to disable NetBIOS over TCP/IP on affected network adapters.
Frequently Asked Questions: Answers common questions about NetBIOS over TCP/IP, including whether it is required, what risks it introduces, which ports are typically associated with it, and how to check if it is enabled on Windows devices.
NetBIOS over TCP/IP is a legacy setting that may remain enabled for compatibility, but if you don’t rely on NetBIOS-based name resolution or file and printer sharing in your environment, disabling it helps reduce unnecessary exposure. On roaming devices, NetBIOS traffic can become reachable on less trusted networks, and NetBIOS-related services can reveal system and network details that aid discovery and lateral movement. If your environment needs NetBIOS for specific legacy systems, limit it to only those endpoints and disable it everywhere else.
You can detect this misconfiguration (NetBios over TCP/IP is not disabled) using Vulnerability Manager Plus. using Vulnerability Manager Plus. This misconfiguration comes under the category of Legacy Protocols and has a Critical severity.
NetBIOS over TCP/IP is a legacy networking feature that lets older Windows applications and services use NetBIOS naming and session services over TCP/IP networks. Historically, it was used for functions such as computer name resolution on local networks and supporting file and printer sharing in environments that relied on older discovery methods.
In modern Windows networks, these functions are typically handled by newer, more secure mechanisms (for example, DNS-based name resolution and directory-based service discovery). Because of this, NetBIOS over TCP/IP is generally considered a legacy protocol and is not required in many environments unless you still run older applications or systems that depend on it.
When NetBIOS over TCP/IP is enabled, endpoints may expose NetBIOS-related services that can help an attacker discover devices, enumerate network shares, and identify domain or system information. This can make reconnaissance easier and, in some cases, support lateral movement within a network. Disabling NetBIOS over TCP/IP where it is not needed is a common security-hardening step to reduce the attack surface of Windows endpoints.
To detect this misconfiguration:
To remediate the misconfiguration:
Potential Operational Impact: Legacy protocols are present to support operations of legacy applications and services. Disabling them would cause those applications to stop functioning.
Scheduling reports keeps teams informed without needing to log in manually.
Refer to this page to know in detail more about misconfiguration hardening
On Windows (per network adapter):
In most modern environments, yes—especially on end-user devices. The TCP/IP NetBIOS Helper service supports legacy name resolution and NetBIOS-related functions. Disabling it can break older dependencies like legacy discovery, older apps, or environments that still rely on NetBIOS/WINS.
Tip: If you still use legacy SMB browsing or WINS-based name resolution, test before enforcing broadly.
NetBIOS over TCP/IP (NetBT) is a legacy mechanism used for:
Modern networks generally prefer DNS and newer discovery mechanisms instead of NetBIOS.
NetBIOS over TCP/IP is configured under IPv4 settings. To disable it:
This disables NetBIOS over IPv4 for that adapter.
Disabling NetBIOS is commonly recommended because it reduces exposure to legacy behaviors and unnecessary network chatter, such as:
If your environment doesn’t require NetBIOS/WINS, disabling it is a good hardening step.
On Windows, you generally should not “turn off TCP/IP” because it’s the core networking stack. If your goal is to disable network connectivity, use one of these safer options:
Note: Disabling IPv4/IPv6 can break domain access, browsing, and most network apps.
It depends on the Windows version and network configuration. In many modern setups, NetBIOS is not required and may be set to:
The reliable way is to check the adapter setting in IPv4 > Advanced > WINS.
On Windows:
If IPv4/IPv6 are unchecked, that protocol is disabled for the adapter.
On Windows:
Tip: In managed environments, IP settings are typically controlled by DHCP or policy.
You can reset the Windows network stack using built-in options:
Or via an elevated Command Prompt:
Restart the device after resetting for changes to fully apply.
If you mean disabling the TCP/IP protocol binding on an adapter:
Warning: This will likely break most networking (domain access, internet, and many apps). Prefer disabling NetBIOS over TCP/IP or the adapter if your goal is hardening or isolation.
Quickest methods on Windows:
To enable TCP/IP protocol bindings on an adapter:
If settings are managed by policy, you may need administrator access or your IT team to re-enable them.
On Windows:
These checks help confirm whether a port is reachable and whether a TCP session is established.