I would like to modify Win OS banner to defeat OS detection from scanning tools like
Nmap for example. Although, I know that
Nmap does not take into account just the banner to do OS detection.
I suppose you're talking about the OS Fingerprint, which used to be a simple OS File that you could modify or replace.
However, with newer scan techniques, and combined scan techniques, modification of the fingerprint will no longer be sufficient to effectively hide your OS from nmap.
For example, the scanner looks at some TCP Properties, like the TTL and TCP Window size:
Operating System Time To Live TCP Window Size Linux (Kernel 2.4 and 2.6) 64 5840 Google Linux 64 5720 FreeBSD 64 65535 Windows XP 128 65535 Windows Vista and 7 (Server 2008) 128 8192 iOS 12.4 (Cisco Routers) 255 4128
Then again, there's also "logic", if you have IIS or Windows RDS running, you're probably running Windows, if an NGINX banner is found, you're likely running Linux.
So in order to effectively hide your operating system from an attacker, you will need to hide banners from several services in order to get the desired effect.
Best would be to perform scans yourself, and take down identifiable banners one by one.