14

I want to disable file sharing (SMB) on Windows XP and I turned it off in the network properties dialog box, but the system is still listening on port 445. Is there a way to make it stop listening on 445 entirely? Is it still on in stealth mode?

enter image description here

7
  • 7
    Just install the patch for Windows XP that fixes the SMB exploit – Ramhound May 14 '17 at 2:28
  • 7
    @Ramhound Even with a fix for the current vulnerability, SMB is still a pretty large attack surface. – CodesInChaos May 14 '17 at 10:43
  • 1
    You can always use the built-in firewall, block everything except what you need to listen. – Sam May 14 '17 at 11:59
  • @Sam Good idea, block buggy software I don't use with... more buggy software I don't use. I have a better idea: turn the buggy software off. – Tyler Durden May 14 '17 at 13:54
  • The current answers don't actually disable SMBv1, this article explains how to do that – Ramhound May 14 '17 at 18:22
14

I figured out how to do this from another post.

Add the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters

Name: SMBDeviceEnabled Type: DWORD (REG_DWORD) Data: 0

This will completely disable SMB services and shutdown the server that listens on 445. Restart computer to take effect. You can verify that it is off by using netstat -an

6
  • 4
    Did you try disabling the Server service? – Todd Wilcox May 14 '17 at 6:07
  • 5
    The correct action is to flag your question as a duplicate, not answer it without even attributing to the source Q&A. – AStopher May 14 '17 at 17:11
  • This doesn't disable SMBv1 though – Ramhound May 14 '17 at 18:23
  • 1
    @Ramhound It shuts down port 445. What port is "SMBv1" using? – Tyler Durden May 14 '17 at 18:27
  • After adding the key, the command: netstat -na | find "LISTENING" | find ":445", returns empty - so nobody listening on 445 – Lucio M. Tato May 15 '17 at 22:33
7

Command line method

Assuming the current user is a member of the Administrators group, open a command prompt and enter:

reg add HKLM\System\CurrentControlSet\Services\NetBT\Parameters /V SmbDeviceEnabled /T REG_DWORD /F /D 0

(this adds the required registry setting to disable SMB, and is the CLI equivalent of the OP's answer)

Then enter:

sc stop lanmanserver
sc config lanmanserver start= disabled

(this stops and disables the server service, a.k.a lanmanserver)

Restart your computer:

shutdown -r -t 01

After the restart, open a command prompt and enter the following command to verify that SMB is no longer listening on port 445:

netstat -na | find "LISTENING" | find ":445 "

If no output is returned by this command, you're all good!

Another possible method involving the GUI

...is to uninstall File and Printer Sharing for Microsoft Networks completely:

  1. Go to Start | Control Panel, and double-click the Network Connections applet.
  2. Right-click Local Area Connection (i.e., the Internet-facing connection), and select Properties.
  3. Select File And Printer Sharing For Microsoft Networks, and click the Uninstall button.
  4. Choose Yes when prompted to uninstall the component. Close all dialog boxes and applets.

For those that might benefit from a guide with screenshots, see:
http://ca.huji.ac.il/services/security/sharingXP-uninstall.shtml

2
  • 2
    I already had Server turned off. It was still listening on 445. The port is owned by PID 4, which is basically the kernel, it is not a service. The service portion is, I think, just some kind of front end. The actual server itself is not actually in the "Server" service, so turning off Server, does not turn off the 445 listener. – Tyler Durden May 14 '17 at 14:01
  • I've updated my answer based on your experience - belt n braces probably best! I'm seeing mixed results with regard whether you need to modify both registry setting & service state. On an XP box I tested, modifying the reg was enough, and on my own 7 box, stopping the service was enough. Possibly the order of modifications makes a difference. – Jimadine May 17 '17 at 20:16
1

As this vulnerability targets SMB and NetBT, it can be removed with cmd (if these services are not required)::

::Disable netbt service
net stop netbt & sc delete netbt
net stop netbios & sc delete netbios

::Disable Workstation Service
sc stop "LanmanWorkstation"
sc config "LanmanWorkstation" start= disabled
sc delete "LanmanWorkstation"

::Disable SMB feature (windows 7 or higher)
DISM /Online /Disable-Feature /FeatureName:SMB1Protocol /Remove /NoRestart
DISM /Online /Disable-Feature /FeatureName:SmbDirect /Remove /NoRestart

::File and Printer Sharing for Microsoft Networks       
netcfg /u ms_server

Run this as administrator and restart PC. These commands will remove the services permanently. You may close the ports in firewall.

4

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.