Due the vulnerability in Windows SMB Server (MS17-010), how can I tell if it is running? I am using Windows XP. None of the services I have running has the word "SMB" in the title or description.

What is the name of the service that implements SMB Server?

  • 3
    I see that you're asking for a security reason, but I find that a better question for superuser.
    – Arminius
    Commented May 13, 2017 at 8:37
  • In Windows 10, if you go to Add/Remove programs in the Control Panel, you can remove SMB as a feature. Dunno if something similar might work in Windows XP.
    – Nat
    Commented May 14, 2017 at 4:36

3 Answers 3


Answer to this question:

(1) There is no service that runs the SMB server. It is a native system process that runs in the NT kernel.

(2) If the kernel is running SMB, it can be detected by giving the command netstat -an to display all network listeners. If port 445 is listening, then it means the SMB server is running.


In Windows, you can open cmd.exe and run this command:

sc query mrxsmb10

In addition, you can also check to see in Windows Registry if there is a key for SMB in (it's not always present):


Lastly, powershell can be useful. Open PowerShell in Windows and run:



SMB is Server Message Block protocol–it's used for file sharing so if you have enabled windows file-sharing–you have a service using the SMB protocol.

If you are on Windows XP you would have to turn off all the file sharing which means no access either to or from files on the machine.

You could try in you network adapter settings to locate a binding named something like "File and Print Sharing for Microsoft Networks", and unbind this. It may be just as easy as turning off the network card.

See also Disable file sharing on Windows XP on Superuser as my suggestion to unbind evidently doesn't work.

  • What is the service that implements it? My understanding is that SMB is only for Samba sharing and that Windows-only sharing uses a different protocol. Commented May 13, 2017 at 5:01
  • I believe Workstation and Server may be some of the services which support file sharing. You may be correct that XP had other protocols - but SMB is the file sharing protocol for Windows now. I think if you have Windows XP and have file-sharing working then you are running SMB
    – Ross
    Commented May 13, 2017 at 5:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .