Need TCP NetBIOS Helper to Access Active Directory Server

[Will]

On Windows 2000 machines on our network, if you look up the Active Directory
name with:

nslookup corp.mydomain.com

this resolves to the IP address of the Active Directory server. If
however you simply try to access it directly with:

dir \\corp.mydomain.com\sysvol

this fails with a message that the location cannot be resolved.

As soon as you turn on the TCP/IP NetBIOS Helper service, now you are able
to access the AD server using its fully-qualified DNS name. Why in the
world would you need a NetBIOS Helper service to locate an AD server using
its direct DNS name? At very least that creates a security problem
doesn't it? Even with NTLM disabled, does the file service still use some
form of NETBEUI protocol? What specific components within TCP/IP NetBIOS
Helper service do we need here?

 

[Kevin D. Goodknecht Sr. [MVP]]

On Windows 2000 machines on our network, if you look up the Active
Directory name with:

nslookup corp.mydomain.com

this resolves to the IP address of the Active Directory server. If
however you simply try to access it directly with:

dir \\corp.mydomain.com\sysvol

this fails with a message that the location cannot be resolved.

As soon as you turn on the TCP/IP NetBIOS Helper service, now you are
able to access the AD server using its fully-qualified DNS name.
Why in the world would you need a NetBIOS Helper service to locate an
AD server using its direct DNS name? At very least that creates a
security problem doesn't it? Even with NTLM disabled, does the file
service still use some form of NETBEUI protocol? What specific
components within TCP/IP NetBIOS Helper service do we need here?

There are a lot of questions like that, the only answer I can give you is
the TCP/IP NetBIOS helper service is required to access DFS shares. Which
means of course it is required to access Group Policies, since Group
Policies are located in the domain DFS share.

 

[Will]

So what security holes are we creating by running TCP/NETBIOS
Helper on each computer in our domain?

 

[Kevin D. Goodknecht Sr. [MVP]]

So what security holes are we creating by running TCP/NETBIOS
Helper on each computer in our domain?

None that I know of.