Disabling File and Print Sharing Without Breaking Admin Tools

I really need some help...I've got an anti-Microsoft boss that really wants
to disable File and Print Sharing on every workstation.

What is the correlation between File and Printer Sharing service, NetBIOS
and remote administration tools?

I've discovered that when File and Printer Sharing is disabled on a 2000
computer, it cannot be reached by remote administration tools...most notably
Computer Management, but also tools such as exporter, DumpACL, etc.
We're trying to do away with the service because of the security issues it
opens up, but I can't go to each computer in the entire enterprise when I
want to quickly check something.

Shouldn't having NetBIOS over TCP enabled allow me to remotely administer a
workstation? Is there a way to remove File and Printer Sharing, yet still
be able to remotely administer workstations?

"CJH" <chaselton AT gmail DOT com> wrote in message
news:(E-Mail Removed)...
> I really need some help...I've got an anti-Microsoft boss that really
wants
> to disable File and Print Sharing on every workstation.

You need File & Print sharing to function properly on the LAN and the
Domain.

> We're trying to do away with the service because of the security issues it
> opens up,

It doesn't open up any "security issues" on a LAN. It would on the
Internet,..but they aren't on the Internet,...accessing the Internet from
behind a NAT Device or Proxy is not "being on the Internet".

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/IS...cessRules.html

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/t...dance/2004.asp
http://www.microsoft.com/isaserver/t...dance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp
-----------------------------------------------------

Thanks, but you've only partially answered my question.

Why is File and Printer Sharing needed to have a properly functioning LAN or
Domain? Wouldn't NetBIOS be the only thing required?

I'm not trying to be difficult...I really do need the "why". I've said over
and over again that File and Print sharing needs to be enabled for the
Domain/LAN to work properly but that answer alone isn't enough for my
supervisor (did I mention he was rabidly anti-Microsoft, very paranoid and
has probably read every article warning against the dangers of NBT).

Is it that File and Print Sharing is tightly integrated with NetBIOS? Is it
because File and Print Sharing allows for legacy OS's to function? We're
only running 2000 Professional, Server and 2003 Server...with very few
exceptions.

Please provide more info.

"Phillip Windell" <@.> wrote in message
news:(E-Mail Removed)...
>
> "CJH" <chaselton AT gmail DOT com> wrote in message
> news:(E-Mail Removed)...
>> I really need some help...I've got an anti-Microsoft boss that really
> wants
>> to disable File and Print Sharing on every workstation.
>
> You need File & Print sharing to function properly on the LAN and the
> Domain.
>
>> We're trying to do away with the service because of the security issues
>> it
>> opens up,
>
> It doesn't open up any "security issues" on a LAN. It would on the
> Internet,..but they aren't on the Internet,...accessing the Internet from
> behind a NAT Device or Proxy is not "being on the Internet".
>
> --
> Phillip Windell [MCP, MVP, CCNA]
> www.wandtv.com
> -----------------------------------------------------
> Understanding the ISA 2004 Access Rule Processing
> http://www.isaserver.org/articles/IS...cessRules.html
>
> Microsoft Internet Security & Acceleration Server: Guidance
> http://www.microsoft.com/isaserver/t...dance/2004.asp
> http://www.microsoft.com/isaserver/t...dance/2000.asp
>
> Microsoft Internet Security & Acceleration Server: Partners
> http://www.microsoft.com/isaserver/partners/default.asp
> -----------------------------------------------------
>
>
>
>

No, file and printer sharing are not tightly integrated with Netbios. It
will run without Netbios at all. See KB 315267 (or 204279 for pre XP
version) on direct hosting of SMB over TCP/IP.

But this will not solve all of your problems. Some applications and
utilities will try to use Netbios names anyway. And if you disable Netbios
over TCP/IP you will lose the convenience of the computer browser service,
which uses Netbios names.

CJH wrote:
> Thanks, but you've only partially answered my question.
>
> Why is File and Printer Sharing needed to have a properly functioning
> LAN or Domain? Wouldn't NetBIOS be the only thing required?
>
> I'm not trying to be difficult...I really do need the "why". I've
> said over and over again that File and Print sharing needs to be
> enabled for the Domain/LAN to work properly but that answer alone
> isn't enough for my supervisor (did I mention he was rabidly
> anti-Microsoft, very paranoid and has probably read every article
> warning against the dangers of NBT).
> Is it that File and Print Sharing is tightly integrated with NetBIOS?
> Is it because File and Print Sharing allows for legacy OS's to
> function? We're only running 2000 Professional, Server and 2003
> Server...with very few exceptions.
>
> Please provide more info.
>
> "Phillip Windell" <@.> wrote in message
> news:(E-Mail Removed)...
>>
>> "CJH" <chaselton AT gmail DOT com> wrote in message
>> news:(E-Mail Removed)...
>>> I really need some help...I've got an anti-Microsoft boss that
>>> really wants to disable File and Print Sharing on every workstation.
>>
>> You need File & Print sharing to function properly on the LAN and the
>> Domain.
>>
>>> We're trying to do away with the service because of the security
>>> issues it
>>> opens up,
>>
>> It doesn't open up any "security issues" on a LAN. It would on the
>> Internet,..but they aren't on the Internet,...accessing the Internet
>> from behind a NAT Device or Proxy is not "being on the Internet".
>>
>> --
>> Phillip Windell [MCP, MVP, CCNA]
>> www.wandtv.com
>> -----------------------------------------------------
>> Understanding the ISA 2004 Access Rule Processing
>> http://www.isaserver.org/articles/IS...cessRules.html
>>
>> Microsoft Internet Security & Acceleration Server: Guidance
>> http://www.microsoft.com/isaserver/t...dance/2004.asp
>> http://www.microsoft.com/isaserver/t...dance/2000.asp
>>
>> Microsoft Internet Security & Acceleration Server: Partners
>> http://www.microsoft.com/isaserver/partners/default.asp
>> -----------------------------------------------------

"CJH" <chaselton AT gmail DOT com> wrote in message
news:(E-Mail Removed)...
> I'm not trying to be difficult...I really do need the "why". I've said
over
> and over again that File and Print sharing needs to be enabled for the
> Domain/LAN to work properly

I don't have any details like that. I would never consider doing such a
thing as disabling that in the first place within a private LAN so I have
never investigated it that deeply.

> but that answer alone isn't enough for my
> supervisor (did I mention he was rabidly anti-Microsoft, very paranoid and
> has probably read every article warning against the dangers of NBT).

Then it isn't going to matter how much of a perfectly detailed text-book
answer I could give. It isn't going to matter if it has become a "religion"
to him or if it is based on "paranoia".

> Is it that File and Print Sharing is tightly integrated with NetBIOS? Is
it
> because File and Print Sharing allows for legacy OS's to function? We're
> only running 2000 Professional, Server and 2003 Server...with very few
> exceptions.

Without File & Print Sharing you lose all the "invisible" Administrative
Shares (C$, D$, ADMIN$, IPC$, etc),...without the Adminitrative Shares,...it
is very likely that Administrative Tool which may depend on those will fail
to function.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/IS...cessRules.html

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/t...dance/2004.asp
http://www.microsoft.com/isaserver/t...dance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp
-----------------------------------------------------