Need TCP NetBIOS Helper to Access Active Directory Server

  • Thread starter Thread starter Will
  • Start date Start date
W

Will

On Windows 2000 machines on our network, if you look up the Active Directory
name with:

nslookup corp.mydomain.com

this resolves to the IP address of the Active Directory server. If
however you simply try to access it directly with:

dir \\corp.mydomain.com\sysvol

this fails with a message that the location cannot be resolved.

As soon as you turn on the TCP/IP NetBIOS Helper service, now you are able
to access the AD server using its fully-qualified DNS name. Why in the
world would you need a NetBIOS Helper service to locate an AD server using
its direct DNS name? At very least that creates a security problem
doesn't it? Even with NTLM disabled, does the file service still use some
form of NETBEUI protocol? What specific components within TCP/IP NetBIOS
Helper service do we need here?
 
Will said:
On Windows 2000 machines on our network, if you look up the Active
Directory name with:

nslookup corp.mydomain.com

this resolves to the IP address of the Active Directory server. If
however you simply try to access it directly with:

dir \\corp.mydomain.com\sysvol

this fails with a message that the location cannot be resolved.

As soon as you turn on the TCP/IP NetBIOS Helper service, now you are
able to access the AD server using its fully-qualified DNS name.
Why in the world would you need a NetBIOS Helper service to locate an
AD server using its direct DNS name? At very least that creates a
security problem doesn't it? Even with NTLM disabled, does the file
service still use some form of NETBEUI protocol? What specific
components within TCP/IP NetBIOS Helper service do we need here?
Click to expand...

There are a lot of questions like that, the only answer I can give you is
the TCP/IP NetBIOS helper service is required to access DFS shares. Which
means of course it is required to access Group Policies, since Group
Policies are located in the domain DFS share.
 
So what security holes are we creating by running TCP/NETBIOS
Helper on each computer in our domain?
 
Back
Top