Master Browser related questions

On a public network, a machine running XP pro, fire walled with the ICF,
happens to become the Master Browser for the Workgroup. I am looking for a
way to stop it.

1. A tried a conflict between it and my Windows 2003 Server: split the
network on two parts, so that my machine becomes MBR, but when I reconnect
the network, my machine will lose.

2. Can I force my machine to always register and act as Master Browser? A
friend of mine has done this with his Linux (for another workgroup).

3. Is there any way to resolve computer name or IP-address (preferably) for
that machine? Or name to IP. Or find the MAC-address.

4. If I know the IP, I can always steal it for a few minutes and the
computer will no longer be Master Browser.

5. Maybe some one will offer a better plan?

Thanks for any help and support!

George Valkov

Hi George,
Disable the computer browser service or
use a reg hack. BTW the reg hack will
force an error upon reboot stating the
computer browser will be stopped.

"George Valkov" <(E-Mail Removed)> wrote in message news:e
> On a public network, a machine running XP pro, fire walled with the
ICF,
> happens to become the Master Browser for the Workgroup. I am looking
for a
> way to stop it.
>
> 1. A tried a conflict between it and my Windows 2003 Server: split the
> network on two parts, so that my machine becomes MBR, but when I
reconnect
> the network, my machine will lose.
>
> 2. Can I force my machine to always register and act as Master
Browser? A
> friend of mine has done this with his Linux (for another workgroup).
>
> 3. Is there any way to resolve computer name or IP-address
(preferably) for
> that machine? Or name to IP. Or find the MAC-address.
>
> 4. If I know the IP, I can always steal it for a few minutes and the
> computer will no longer be Master Browser.
>
> 5. Maybe some one will offer a better plan?
>
> Thanks for any help and support!

>

Hello Michael, I want to force my server to BE Master Browser.
The remote machine which is fire walled is not mine and I have no access to
it. That's why I wrote 'public network'. At least if I know it's IP address,
I can cause an IP conflict, which stops the remote Master Browser.

I know how to disable the Computer Browser service. It's hard to make it
always work as Master Browser :-)
.... Actually I know one way, but blocking UDP 138 is not a good idea in this
case :-)


George Valkov


<(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Hi George,
> Disable the computer browser service or
> use a reg hack. BTW the reg hack will
> force an error upon reboot stating the
> computer browser will be stopped.
>
> "George Valkov" <(E-Mail Removed)> wrote in message news:e
> > On a public network, a machine running XP pro, fire walled with the
> ICF,
> > happens to become the Master Browser for the Workgroup. I am looking
> for a
> > way to stop it.
> >
> > 1. A tried a conflict between it and my Windows 2003 Server: split the
> > network on two parts, so that my machine becomes MBR, but when I
> reconnect
> > the network, my machine will lose.
> >
> > 2. Can I force my machine to always register and act as Master
> Browser? A
> > friend of mine has done this with his Linux (for another workgroup).
> >
> > 3. Is there any way to resolve computer name or IP-address
> (preferably) for
> > that machine? Or name to IP. Or find the MAC-address.
> >
> > 4. If I know the IP, I can always steal it for a few minutes and the
> > computer will no longer be Master Browser.
> >
> > 5. Maybe some one will offer a better plan?
> >
> > Thanks for any help and support!
>
> >
>
>

The PDC eumlator will always be the DMB or domain master
browser that you can't change unless you transfer the PDC
emulator role. If you want to make a machine the SMB or
segment master browser you change the following registry
key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Browser\Parameters\IsDo
mainMaster
Change the value of this key to yes, quit Registry Editor, and then restart
your computer.
By default all machines including the PDC will have a value of false but
make sure all other machines have this value set to false.


"George Valkov" <(E-Mail Removed)> wrote in message news:
> Hello Michael, I want to force my server to BE Master Browser.
> The remote machine which is fire walled is not mine and I have no access
to
> it. That's why I wrote 'public network'. At least if I know it's IP
address,
> I can cause an IP conflict, which stops the remote Master Browser.
>
> I know how to disable the Computer Browser service. It's hard to make it
> always work as Master Browser :-)
> ... Actually I know one way, but blocking UDP 138 is not a good idea in
this
> case :-)
>
>
> George Valkov
>
>
> <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
> > Hi George,
> > Disable the computer browser service or
> > use a reg hack. BTW the reg hack will
> > force an error upon reboot stating the
> > computer browser will be stopped.
> >
> > "George Valkov" <(E-Mail Removed)> wrote in message news:e
> > > On a public network, a machine running XP pro, fire walled with the
> > ICF,
> > > happens to become the Master Browser for the Workgroup. I am looking
> > for a
> > > way to stop it.
> > >
> > > 1. A tried a conflict between it and my Windows 2003 Server: split the
> > > network on two parts, so that my machine becomes MBR, but when I
> > reconnect
> > > the network, my machine will lose.
> > >
> > > 2. Can I force my machine to always register and act as Master
> > Browser? A
> > > friend of mine has done this with his Linux (for another workgroup).
> > >
> > > 3. Is there any way to resolve computer name or IP-address
> > (preferably) for
> > > that machine? Or name to IP. Or find the MAC-address.
> > >
> > > 4. If I know the IP, I can always steal it for a few minutes and the
> > > computer will no longer be Master Browser.
> > >
> > > 5. Maybe some one will offer a better plan?
> > >
> > > Thanks for any help and support!
> >
> > >
> >
> >
>
>

My current configuration is
IsDomainMaster = Yes
MaintainServerList = Yes
I set those values right after Windows was installed (a few months ago).

Is there any difference between
Yes and yes
because my server:
1. cannot register as MBR or BBR if there is a fire walled MBR
2. will always register as BBR if the Linux machine of my friend is
running - Linux always registers as MBR.
3. will register as MBR on the next MBR change or at start-up (I'm not
sure).

By the way if there is a fire walled MBR, but the Linux machine is running,
Linux will return a list of all fire walled servers registered as MBR plus
it's own name (no other computers).
browstat view 1



<(E-Mail Removed)> wrote in message
news:u01xC$(E-Mail Removed)...
> The PDC eumlator will always be the DMB or domain master
> browser that you can't change unless you transfer the PDC
> emulator role. If you want to make a machine the SMB or
> segment master browser you change the following registry
> key:
>
>
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Browser\Parameters\IsDo
> mainMaster
> Change the value of this key to yes, quit Registry Editor, and then
restart
> your computer.
> By default all machines including the PDC will have a value of false but
> make sure all other machines have this value set to false.
>
>
> "George Valkov" <(E-Mail Removed)> wrote in message news:
> > Hello Michael, I want to force my server to BE Master Browser.
> > The remote machine which is fire walled is not mine and I have no access
> to
> > it. That's why I wrote 'public network'. At least if I know it's IP
> address,
> > I can cause an IP conflict, which stops the remote Master Browser.
> >
> > I know how to disable the Computer Browser service. It's hard to make it
> > always work as Master Browser :-)
> > ... Actually I know one way, but blocking UDP 138 is not a good idea in
> this
> > case :-)
> >
> >
> > George Valkov
> >
> >
> > <(E-Mail Removed)> wrote in message
> > news:(E-Mail Removed)...
> > > Hi George,
> > > Disable the computer browser service or
> > > use a reg hack. BTW the reg hack will
> > > force an error upon reboot stating the
> > > computer browser will be stopped.
> > >
> > > "George Valkov" <(E-Mail Removed)> wrote in message news:e
> > > > On a public network, a machine running XP pro, fire walled with the
> > > ICF,
> > > > happens to become the Master Browser for the Workgroup. I am looking
> > > for a
> > > > way to stop it.
> > > >
> > > > 1. A tried a conflict between it and my Windows 2003 Server: split
the
> > > > network on two parts, so that my machine becomes MBR, but when I
> > > reconnect
> > > > the network, my machine will lose.
> > > >
> > > > 2. Can I force my machine to always register and act as Master
> > > Browser? A
> > > > friend of mine has done this with his Linux (for another workgroup).
> > > >
> > > > 3. Is there any way to resolve computer name or IP-address
> > > (preferably) for
> > > > that machine? Or name to IP. Or find the MAC-address.
> > > >
> > > > 4. If I know the IP, I can always steal it for a few minutes and the
> > > > computer will no longer be Master Browser.
> > > >
> > > > 5. Maybe some one will offer a better plan?
> > > >
> > > > Thanks for any help and support!
> > >
> > > >
> > >
> > >
> >
> >
>
>

Browser elections depend on a number of things including the OS version.
Obviously the Linux machine has been set to always win a browser election.
Some sysadmins do this to ensure the same machine is always the master
browser.

Browser elections rely on broadcasts, so firewall settings (and routers)
can affect what happens.

"George Valkov" <(E-Mail Removed)> wrote in message
news:OZwx$#(E-Mail Removed)...
> My current configuration is
> IsDomainMaster = Yes
> MaintainServerList = Yes
> I set those values right after Windows was installed (a few months ago).
>
> Is there any difference between
> Yes and yes
> because my server:
> 1. cannot register as MBR or BBR if there is a fire walled MBR
> 2. will always register as BBR if the Linux machine of my friend is
> running - Linux always registers as MBR.
> 3. will register as MBR on the next MBR change or at start-up (I'm not
> sure).
>
> By the way if there is a fire walled MBR, but the Linux machine is
running,
> Linux will return a list of all fire walled servers registered as MBR plus
> it's own name (no other computers).
> browstat view 1
>
>
>
> <(E-Mail Removed)> wrote in message
> news:u01xC$(E-Mail Removed)...
> > The PDC eumlator will always be the DMB or domain master
> > browser that you can't change unless you transfer the PDC
> > emulator role. If you want to make a machine the SMB or
> > segment master browser you change the following registry
> > key:
> >
> >
>
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Browser\Parameters\IsDo
> > mainMaster
> > Change the value of this key to yes, quit Registry Editor, and then
> restart
> > your computer.
> > By default all machines including the PDC will have a value of false but
> > make sure all other machines have this value set to false.
> >
> >
> > "George Valkov" <(E-Mail Removed)> wrote in message news:
> > > Hello Michael, I want to force my server to BE Master Browser.
> > > The remote machine which is fire walled is not mine and I have no
access
> > to
> > > it. That's why I wrote 'public network'. At least if I know it's IP
> > address,
> > > I can cause an IP conflict, which stops the remote Master Browser.
> > >
> > > I know how to disable the Computer Browser service. It's hard to make
it
> > > always work as Master Browser :-)
> > > ... Actually I know one way, but blocking UDP 138 is not a good idea
in
> > this
> > > case :-)
> > >
> > >
> > > George Valkov
> > >
> > >
> > > <(E-Mail Removed)> wrote in message
> > > news:(E-Mail Removed)...
> > > > Hi George,
> > > > Disable the computer browser service or
> > > > use a reg hack. BTW the reg hack will
> > > > force an error upon reboot stating the
> > > > computer browser will be stopped.
> > > >
> > > > "George Valkov" <(E-Mail Removed)> wrote in message news:e
> > > > > On a public network, a machine running XP pro, fire walled with
the
> > > > ICF,
> > > > > happens to become the Master Browser for the Workgroup. I am
looking
> > > > for a
> > > > > way to stop it.
> > > > >
> > > > > 1. A tried a conflict between it and my Windows 2003 Server: split
> the
> > > > > network on two parts, so that my machine becomes MBR, but when I
> > > > reconnect
> > > > > the network, my machine will lose.
> > > > >
> > > > > 2. Can I force my machine to always register and act as Master
> > > > Browser? A
> > > > > friend of mine has done this with his Linux (for another
workgroup).
> > > > >
> > > > > 3. Is there any way to resolve computer name or IP-address
> > > > (preferably) for
> > > > > that machine? Or name to IP. Or find the MAC-address.
> > > > >
> > > > > 4. If I know the IP, I can always steal it for a few minutes and
the
> > > > > computer will no longer be Master Browser.
> > > > >
> > > > > 5. Maybe some one will offer a better plan?
> > > > >
> > > > > Thanks for any help and support!
> > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>

Hi George,

By default a SAMBA server will register the domain name 1b
unique name for domains and become domain master browser.

The personal firewall feature will block the necessary port
needed for NetBIOS.

MaintainServerList tells the machine to act as a master browser
by maintaining the browse list, a setting of false will force an error
and stop the computer browser service.

IsDomainMaster gives the computer a better shot at becoming
the segment master browser (SMB). The SMB is responsible
for gathering the local browse list for it's given endpoint and
passing back to the domain master browser (DMB). The PDC
or PDC emulator is always the DMB which cannot change, it registers
a NetBIOS domain name 1b unique name for domains guarenteeing
this. The DMB will query all 1b names in order to gather a merged
browse list which it then passes back to all SMBs. By default the PDC
will act as SMB on it's given endpoint unless another machine is
configured to be the SMB i.e. IsDomainMaster set to yes. The
IsDomainMaster is set to false by default on the PDC.


"George Valkov" <(E-Mail Removed)> wrote in message news:
> My current configuration is
> IsDomainMaster = Yes
> MaintainServerList = Yes
> I set those values right after Windows was installed (a few months
ago).
>
> Is there any difference between
> Yes and yes
> because my server:
> 1. cannot register as MBR or BBR if there is a fire walled MBR
> 2. will always register as BBR if the Linux machine of my friend is
> running - Linux always registers as MBR.
> 3. will register as MBR on the next MBR change or at start-up (I'm not
> sure).
>
> By the way if there is a fire walled MBR, but the Linux machine is
running,
> Linux will return a list of all fire walled servers registered as MBR
plus
> it's own name (no other computers).
> browstat view 1

Yes! If UDP 138 port is blocked (for example: firewall or IPSecpol), the
server will not receive my message to stop acting as the Master Browser:
browstat tic 1 \\server
browstat tic 1 workgroup

I don't know if the following is possible to realize, but I think that if
for any reason (blocked ports / fire wall), a computer detects that it
cannot operate as a Master Browser properly, it should stop in order to
pervert Denial of Service on the workgroup's browse ability.

I read about computer browsers and elections. I understand the way that an
election works. The primary vote is for computer version. Then Server >
Workstation and so on...
If a server (for example a SAMBA server) wants to become the Master Browser:
1. Register domain name 1b
2. It will force election
3. It will spoof his version

Here is the registration of a Linux SAMBA server
\\MBR NT 00.00 (W,S,PQ,XN,NT,SS,MBR,00080000) Master Browser

Can I spoof Windows version from the registry, from where, is it a good idea
or is it unsafe?

George Valkov


"Bill Grant" <not.available@online> wrote in message
news:(E-Mail Removed)...
> Browser elections depend on a number of things including the OS
version.
> Obviously the Linux machine has been set to always win a browser election.
> Some sysadmins do this to ensure the same machine is always the master
> browser.
>
> Browser elections rely on broadcasts, so firewall settings (and
routers)
> can affect what happens.
>
> "George Valkov" <(E-Mail Removed)> wrote in message
> news:OZwx$#(E-Mail Removed)...
> > My current configuration is
> > IsDomainMaster = Yes
> > MaintainServerList = Yes
> > I set those values right after Windows was installed (a few months ago).
> >
> > Is there any difference between
> > Yes and yes
> > because my server:
> > 1. cannot register as MBR or BBR if there is a fire walled MBR
> > 2. will always register as BBR if the Linux machine of my friend is
> > running - Linux always registers as MBR.
> > 3. will register as MBR on the next MBR change or at start-up (I'm not
> > sure).
> >
> > By the way if there is a fire walled MBR, but the Linux machine is
> running,
> > Linux will return a list of all fire walled servers registered as MBR
plus
> > it's own name (no other computers).
> > browstat view 1
> >
> >
> >
> > <(E-Mail Removed)> wrote in message
> > news:u01xC$(E-Mail Removed)...
> > > The PDC eumlator will always be the DMB or domain master
> > > browser that you can't change unless you transfer the PDC
> > > emulator role. If you want to make a machine the SMB or
> > > segment master browser you change the following registry
> > > key:
> > >
> > >
> >
>
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\Browser\Parameters\IsDo
> > > mainMaster
> > > Change the value of this key to yes, quit Registry Editor, and then
> > restart
> > > your computer.
> > > By default all machines including the PDC will have a value of false
but
> > > make sure all other machines have this value set to false.
> > >
> > >
> > > "George Valkov" <(E-Mail Removed)> wrote in message news:
> > > > Hello Michael, I want to force my server to BE Master Browser.
> > > > The remote machine which is fire walled is not mine and I have no
> access
> > > to
> > > > it. That's why I wrote 'public network'. At least if I know it's IP
> > > address,
> > > > I can cause an IP conflict, which stops the remote Master Browser.
> > > >
> > > > I know how to disable the Computer Browser service. It's hard to
make
> it
> > > > always work as Master Browser :-)
> > > > ... Actually I know one way, but blocking UDP 138 is not a good idea
> in
> > > this
> > > > case :-)
> > > >
> > > >
> > > > George Valkov
> > > >
> > > >
> > > > <(E-Mail Removed)> wrote in message
> > > > news:(E-Mail Removed)...
> > > > > Hi George,
> > > > > Disable the computer browser service or
> > > > > use a reg hack. BTW the reg hack will
> > > > > force an error upon reboot stating the
> > > > > computer browser will be stopped.
> > > > >
> > > > > "George Valkov" <(E-Mail Removed)> wrote in message news:e
> > > > > > On a public network, a machine running XP pro, fire walled with
> the
> > > > > ICF,
> > > > > > happens to become the Master Browser for the Workgroup. I am
> looking
> > > > > for a
> > > > > > way to stop it.
> > > > > >
> > > > > > 1. A tried a conflict between it and my Windows 2003 Server:
split
> > the
> > > > > > network on two parts, so that my machine becomes MBR, but when I
> > > > > reconnect
> > > > > > the network, my machine will lose.
> > > > > >
> > > > > > 2. Can I force my machine to always register and act as Master
> > > > > Browser? A
> > > > > > friend of mine has done this with his Linux (for another
> workgroup).
> > > > > >
> > > > > > 3. Is there any way to resolve computer name or IP-address
> > > > > (preferably) for
> > > > > > that machine? Or name to IP. Or find the MAC-address.
> > > > > >
> > > > > > 4. If I know the IP, I can always steal it for a few minutes and
> the
> > > > > > computer will no longer be Master Browser.
> > > > > >
> > > > > > 5. Maybe some one will offer a better plan?
> > > > > >
> > > > > > Thanks for any help and support!
> > > > >
> > > > > >
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>

Hello Michael!
Thank You for the useful information!

Can I force my server to register domain name 1b, without making it a Domain
Controller?

George Valkov


<(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Hi George,
>
> By default a SAMBA server will register the domain name 1b
> unique name for domains and become domain master browser.
>
> The personal firewall feature will block the necessary port
> needed for NetBIOS.
>
> MaintainServerList tells the machine to act as a master browser
> by maintaining the browse list, a setting of false will force an error
> and stop the computer browser service.
>
> IsDomainMaster gives the computer a better shot at becoming
> the segment master browser (SMB). The SMB is responsible
> for gathering the local browse list for it's given endpoint and
> passing back to the domain master browser (DMB). The PDC
> or PDC emulator is always the DMB which cannot change, it registers
> a NetBIOS domain name 1b unique name for domains guarenteeing
> this. The DMB will query all 1b names in order to gather a merged
> browse list which it then passes back to all SMBs. By default the PDC
> will act as SMB on it's given endpoint unless another machine is
> configured to be the SMB i.e. IsDomainMaster set to yes. The
> IsDomainMaster is set to false by default on the PDC.
>
>
> "George Valkov" <(E-Mail Removed)> wrote in message news:
> > My current configuration is
> > IsDomainMaster = Yes
> > MaintainServerList = Yes
> > I set those values right after Windows was installed (a few months
> ago).
> >
> > Is there any difference between
> > Yes and yes
> > because my server:
> > 1. cannot register as MBR or BBR if there is a fire walled MBR
> > 2. will always register as BBR if the Linux machine of my friend is
> > running - Linux always registers as MBR.
> > 3. will register as MBR on the next MBR change or at start-up (I'm not
> > sure).
> >
> > By the way if there is a fire walled MBR, but the Linux machine is
> running,
> > Linux will return a list of all fire walled servers registered as MBR
> plus
> > it's own name (no other computers).
> > browstat view 1
>
>

No you cannot and it's not a good idea. SAMBA running in
DC mode causes all kind of problems in an NT 4.0 domain.

In NT 4.0 the PDC contains the only modifiable copy of the
SAM database so it must be contacted when making any
domain wide changes e.g., new computers, password change,
hidden machine account password changes. Machines will
resolve the 1b name to find the PDC of the domain.

BTW it's not just the machine account.

Information on Browser Operation
http://support.microsoft.com/default...b;en-us;102878


"George Valkov" <(E-Mail Removed)> wrote in message news:
> Hello Michael!
> Thank You for the useful information!
>
> Can I force my server to register domain name 1b, without making it a
Domain
> Controller?