15

I want to disable file sharing (SMB) on Windows XP and I turned it off in the network properties dialog box, but the system is still listening on port 445. Is there a way to make it stop listening on 445 entirely? Is it still on in stealth mode?

enter image description here

7
  • 7
    Just install the patch for Windows XP that fixes the SMB exploit
    – Ramhound
    May 14, 2017 at 2:28
  • 7
    @Ramhound Even with a fix for the current vulnerability, SMB is still a pretty large attack surface. May 14, 2017 at 10:43
  • 1
    You can always use the built-in firewall, block everything except what you need to listen.
    – Sam
    May 14, 2017 at 11:59
  • 1
    @Sam Good idea, block buggy software I don't use with... more buggy software I don't use. I have a better idea: turn the buggy software off. May 14, 2017 at 13:54
  • The current answers don't actually disable SMBv1, this article explains how to do that
    – Ramhound
    May 14, 2017 at 18:22

3 Answers 3

14

I figured out how to do this from another post.

Add the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters

Name: SMBDeviceEnabled Type: DWORD (REG_DWORD) Data: 0

This will completely disable SMB services and shutdown the server that listens on 445. Restart computer to take effect. You can verify that it is off by using netstat -an

6
  • 4
    Did you try disabling the Server service? May 14, 2017 at 6:07
  • 5
    The correct action is to flag your question as a duplicate, not answer it without even attributing to the source Q&A.
    – AStopher
    May 14, 2017 at 17:11
  • This doesn't disable SMBv1 though
    – Ramhound
    May 14, 2017 at 18:23
  • 1
    @Ramhound It shuts down port 445. What port is "SMBv1" using? May 14, 2017 at 18:27
  • After adding the key, the command: netstat -na | find "LISTENING" | find ":445", returns empty - so nobody listening on 445 May 15, 2017 at 22:33
7

Command line method

Assuming the current user is a member of the Administrators group, open a command prompt and enter:

reg add HKLM\System\CurrentControlSet\Services\NetBT\Parameters /V SmbDeviceEnabled /T REG_DWORD /F /D 0

(this adds the required registry setting to disable SMB, and is the CLI equivalent of the OP's answer)

Then enter:

sc stop lanmanserver
sc config lanmanserver start= disabled

(this stops and disables the server service, a.k.a lanmanserver)

Restart your computer:

shutdown -r -t 01

After the restart, open a command prompt and enter the following command to verify that SMB is no longer listening on port 445:

netstat -na | find "LISTENING" | find ":445 "

If no output is returned by this command, you're all good!

Another possible method involving the GUI

...is to uninstall File and Printer Sharing for Microsoft Networks completely:

  1. Go to Start | Control Panel, and double-click the Network Connections applet.
  2. Right-click Local Area Connection (i.e., the Internet-facing connection), and select Properties.
  3. Select File And Printer Sharing For Microsoft Networks, and click the Uninstall button.
  4. Choose Yes when prompted to uninstall the component. Close all dialog boxes and applets.

For those that might benefit from a guide with screenshots, see:
http://ca.huji.ac.il/services/security/sharingXP-uninstall.shtml

2
  • 2
    I already had Server turned off. It was still listening on 445. The port is owned by PID 4, which is basically the kernel, it is not a service. The service portion is, I think, just some kind of front end. The actual server itself is not actually in the "Server" service, so turning off Server, does not turn off the 445 listener. May 14, 2017 at 14:01
  • I've updated my answer based on your experience - belt n braces probably best! I'm seeing mixed results with regard whether you need to modify both registry setting & service state. On an XP box I tested, modifying the reg was enough, and on my own 7 box, stopping the service was enough. Possibly the order of modifications makes a difference.
    – Jimadine
    May 17, 2017 at 20:16
1

As this vulnerability targets SMB and NetBT, it can be removed with cmd (if these services are not required)::

::Disable netbt service
net stop netbt & sc delete netbt
net stop netbios & sc delete netbios

::Disable Workstation Service
sc stop "LanmanWorkstation"
sc config "LanmanWorkstation" start= disabled
sc delete "LanmanWorkstation"

::Disable SMB feature (windows 7 or higher)
DISM /Online /Disable-Feature /FeatureName:SMB1Protocol /Remove /NoRestart
DISM /Online /Disable-Feature /FeatureName:SmbDirect /Remove /NoRestart

::File and Printer Sharing for Microsoft Networks       
netcfg /u ms_server

Run this as administrator and restart PC. These commands will remove the services permanently. You may close the ports in firewall.

4

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .