2

Due the vulnerability in Windows SMB Server (MS17-010), how can I tell if it is running? I am using Windows XP. None of the services I have running has the word "SMB" in the title or description.

What is the name of the service that implements SMB Server?

  • 3
    I see that you're asking for a security reason, but I find that a better question for superuser. – Arminius May 13 '17 at 8:37
  • In Windows 10, if you go to Add/Remove programs in the Control Panel, you can remove SMB as a feature. Dunno if something similar might work in Windows XP. – Nat May 14 '17 at 4:36
4

Answer to this question:

(1) There is no service that runs the SMB server. It is a native system process that runs in the NT kernel.

(2) If the kernel is running SMB, it can be detected by giving the command netstat -an to display all network listeners. If port 445 is listening, then it means the SMB server is running.

4

In Windows, you can open cmd.exe and run this command:

sc query mrxsmb10

In addition, you can also check to see in Windows Registry if there is a key for SMB in (it's not always present):

HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

Lastly, powershell can be useful. Open PowerShell in Windows and run:

Get-SmbServerConfiguration

2

SMB is Server Message Block protocol–it's used for file sharing so if you have enabled windows file-sharing–you have a service using the SMB protocol.

If you are on Windows XP you would have to turn off all the file sharing which means no access either to or from files on the machine.

You could try in you network adapter settings to locate a binding named something like "File and Print Sharing for Microsoft Networks", and unbind this. It may be just as easy as turning off the network card.

See also Disable file sharing on Windows XP on Superuser as my suggestion to unbind evidently doesn't work.

  • What is the service that implements it? My understanding is that SMB is only for Samba sharing and that Windows-only sharing uses a different protocol. – Tyler Durden May 13 '17 at 5:01
  • I believe Workstation and Server may be some of the services which support file sharing. You may be correct that XP had other protocols - but SMB is the file sharing protocol for Windows now. I think if you have Windows XP and have file-sharing working then you are running SMB – Ross May 13 '17 at 5:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.