6 Appendix A: Product Behavior
The information in this specification is applicable to the following Microsoft products or supplemental software. References to product versions include updates to those products.
The terms "earlier" and "later", when used with a product version, refer to either all preceding versions or all subsequent versions, respectively. The term "through" refers to the inclusive range of versions. Applicable Microsoft products are listed chronologically in this section.
Windows NT operating system
Windows 98 operating system
Windows Millennium Edition operating system
Windows 2000 operating system
Windows XP operating system
Windows Server 2003 operating system
Windows Vista operating system
Windows Server 2008 operating system
Windows 7 operating system
Windows Server 2008 R2 operating system
Windows 8 operating system
Windows Server 2012 operating system
Windows 8.1 operating system
Windows Server 2012 R2 operating system
Windows 10 operating system
Windows Server 2016 operating system
Windows Server 2019 operating system
Windows Server 2022 operating system
Windows 11 operating system
Windows Server 2025 operating system
Exceptions, if any, are noted in this section. If an update version, service pack or Knowledge Base (KB) number appears with a product name, the behavior changed in that update. The new behavior also applies to subsequent updates unless otherwise specified. If a product edition appears with the product version, behavior is different in that product edition.
Unless otherwise specified, any statement of optional behavior in this specification that is prescribed using the terms "SHOULD" or "SHOULD NOT" implies product behavior in accordance with the SHOULD or SHOULD NOT prescription. Unless otherwise specified, the term "MAY" implies that the product does not follow the prescription.
<1> Section 1.3: The CIFS Browser Protocol is ineffectual on Windows-based servers where only IPv6 is enabled.
<2> Section 1.3: The following statement is valid throughout the document. Windows 98, Windows 2000 Professional operating system, Windows XP, and Windows Vista are not capable of being domain master browsers; Windows Server 2008 operating system and later have the browser off by default, which can be turned on through the "Services" UI (User Interface) in "Computer Management".
<3> Section 1.3: There needs to always be at least one backup server in a network for a network with two machines one is promoted to be a backup browser.
<4> Section 1.8: The following table shows the unsigned 8-bit major and minor operating system version numbers that are used by Windows clients and servers.
|
Operating system |
Major version |
Minor version |
|---|---|---|
|
Windows 98 |
0x04 |
0x0A |
|
Windows Millennium Edition |
0x04 |
0x5A |
|
Windows NT 4.0 operating system |
0x04 |
0x00 |
|
Windows 2000 |
0x05 |
0x00 |
|
Windows XP |
0x05 |
0x01 |
|
Windows Server 2003 |
0x05 |
0x02 |
|
Windows Server 2003 R2 operating system |
0x05 |
0x02 |
|
Windows Vista |
0x06 |
0x00 |
|
Windows Server 2008 |
0x06 |
0x00 |
|
Windows 7 |
0x06 |
0x01 |
|
Windows Server 2008 R2 operating system |
0x06 |
0x01 |
|
Windows 8 |
0x06 |
0x02 |
|
Windows Server 2012 |
0x06 |
0x02 |
|
Windows 8.1 |
0x06 |
0x03 |
|
Windows Server 2012 R2 |
0x06 |
0x03 |
|
Windows 10 and later |
0x0A |
0x00 |
|
Windows Server 2016 and later |
0x0A |
0x00 |
<5> Section 1.8: Windows only uses these values as specified in [MS-ERREF].
<6> Section 2.1: Windows clients always use \MAILSLOT\BROWSE for mailslot requests.
<7> Section 2.1.1.2: Windows–based servers attempt to register the machine group name three times; if all attempts fail, it can be concluded that another server is already the master browser server for this domain. Name registration is as specified in [RFC1001] section 5.2.
<8> Section 2.1.1.2: WINS keeps up to 25 IP addresses for the <domain>[0x1C] group name. The PDC is the only machine that registers the <domain>[0x1B] name with WINS. WINS ensures that the IP address corresponding to the computer that registered <domain>[0x1B] is always placed first in this list of up to 25 IP addresses that registered <domain>[0x1C].
<9> Section 2.2.1: Windows-based servers send announcements to \MAILSLOT\LANMAN, but listen for announcements on both \MAILSLOT\LANMAN and \MAILSLOT\BROWSE as specified in section 2.1.
<10> Section 2.2.1: The Windows announcement frequency is as specified in section 3.2.6.
<11> Section 2.2.1: For more information, see section 1.8 for Windows operating system values.
<12> Section 2.2.1: For more information, see section 1.8 for Windows operating system values.
<13> Section 2.2.1: The comment field in Windows is a single byte containing the value 0x00.
<14> Section 2.2.3: The following table shows the operating system values.
|
Value |
Meaning |
|---|---|
|
0x10000000 |
Windows-based clients. |
|
0x20000000 |
Windows-based servers which act as PDCs. |
<15> Section 2.2.4: The default value on Windows is 0x04.
<16> Section 2.2.4: The value chosen by the Windows client for token is 0x00000001.
<17> Section 2.2.7: Windows clients and servers set BrowserConfigVersionMajor to 0x03.
<18> Section 2.2.7: Windows clients and servers set BrowserConfigVersionMinor to 0x0A.
<19> Section 2.2.7: Windows-based servers leave this field uninitialized, so the value is undefined.
<20> Section 2.2.7: Windows-based servers leave this field uninitialized, so the value is undefined.
<21> Section 2.2.7: Windows-based servers leave this field uninitialized, so the value is undefined.
<22> Section 2.2.9: Windows based clients and server’s ignore the command when this bit is set.
<23> Section 2.2.10: For more information on Windows operating system values, see section 1.8.
<24> Section 2.2.10: For more information about Windows operating system values, see section 1.8.
<25> Section 2.2.10: Windows clients and servers set BrowserConfigVersionMajor to 0x01.
<26> Section 2.2.10: Windows clients and servers set BrowserConfigVersionMinor to 0x0F.
<27> Section 3.1.3: For Windows machines, the requests to enumerate machines on the network would also fail if the initialization has failed.
<28> Section 3.1.5.1.1: The browser client uses an initial token value of 0, and it increments this value every time it makes a GetBackupListRequest.
<29> Section 3.1.5.1.2: The browser client selects up to three of the backup browser servers and uses a pseudo-random number generator to determine which one of the servers to use from that list.
<30> Section 3.1.6: Upon expiration of the timer, a Windows–based client retransmits the GetBackupListRequest twice more and, if both transmissions result in no GetBackupListResponse frames being received, a Windows–based client sends a RequestElection frame (section 2.2.3) with the version and criteria values set to 0. For more information about the election process, see section 3.3.5.8.
<31> Section 3.1.6: Windows increments TokenValue.
<32> Section 3.2.6: Windows 98, Windows 2000, Windows XP, and Windows Server 2003 use the following time-out values (as specified in 3.2.6).
|
Server.HostAnnouncementCount value |
New HostAnnouncement timer value |
|---|---|
|
0, 1 |
4 minutes |
|
2 |
8 minutes |
|
> 2 |
12 minutes |
<33> Section 3.3: There needs to always be at least one backup server in a network for a network with two machines one is promoted to be a backup browser.
<34> Section 3.3: The new local master browser server sends the announcement request only if its Servers List is empty. If the local master browser server was previously a backup browser, it does not send the announcement request.
<35> Section 3.3.1: Windows-based servers retrieve this value by reading the MaintainServerList registry setting. The default value is FALSE, but if MaintainServerList is set to "true", AlwaysActAsDomainController is set to TRUE.
<36> Section 3.3.1: A Windows-based server that is elected to a master browser does not reset the LocalMasterAnnouncement Timer Count.
<37> Section 3.3.1: The contents of the Machine Groups List element are ordered alphabetically.
<38> Section 3.3.1: Windows NT Server operating system sets IsPrimaryDomainController to TRUE if the IsDomainMaster registry key is set.
<39> Section 3.3.1: In Windows, the contents of the Servers List element are ordered alphabetically.
<40> Section 3.3.2: The local master browser will use the time-out values as specified in the DomainAnnouncement table in section 3.3.6.
<41> Section 3.3.2: Windows-based servers use an internal notification API instead of a timer.
<42> Section 3.3.2: The local master browser uses the default time-out values as specified in the LocalMasterAnnouncement table in section 3.3.6.
<43> Section 3.3.2: The local master browser will use the default time-out of 12 minutes.
<44> Section 3.3.2: Windows implementations use the default value of 12 minutes for this timer.
<45> Section 3.3.3: Windows-based servers will set IsDomainController to TRUE if the MaintainServerList registry key is set to "Yes".
<46> Section 3.3.3: In browser initialization, if the server is executing a scheduled announcement and determining whether to become a backup browser or master browser, SV_TYPE_POTENTIAL_BROWSER, SV_TYPE_MASTER_BROWSER, SV_TYPE_BACKUP_BROWSER flags are not set.
<47> Section 3.3.3: Windows 2000 Server operating system operating system and later register as SV_TYPE_SERVER_NT. Windows XP operating system and later do not register this flag.
<48> Section 3.3.5: Malformed messages are written to the Windows event log.
<49> Section 3.3.5.1: If the FindMaster timer expires three times (4.5 seconds), the browser server sends a RequestElection (section 2.2.3) frame.
<50> Section 3.3.5.1: Windows XP, Windows XP Professional operating system, Windows XP 64-Bit Edition operating system, Windows Server 2003, Windows XP Professional x64 Edition operating system, Windows Vista, and Windows Server 2008 acting as the Local Master Browser for a network with fewer than 11 machines on it will return only the local master browser in response to a Get BackupList response. Windows XP Home Edition operating system and Windows Vista will return only the local master browser if fewer than 6 machines are on the network.
<51> Section 3.3.5.7: A Windows local master browser attempts to maintain a number of backup browser servers that it nominates as follows.
|
Number of servers |
Number of backup browser servers |
|---|---|
|
1 |
0 |
|
2-31 |
1 |
|
32-63 |
2 |
|
> 63 |
3 |
<52> Section 3.3.5.7: Windows-based servers attempt to maintain the desired number of backup browser servers as 1 backup browser for every 32 servers in Servers List.
<53> Section 3.3.5.8: A Windows-based server that is elected to a master browser does not reset the LocalMasterAnnouncement Timer Count.
<54> Section 3.3.5.10: For machines running Windows, the ResetState message might not be seen for 17 minutes, because promotion or demotion of backup servers and version checking occurs during the ServerExpiration timer. The timer is delayed for the first 15 minutes after becoming a master where no demotion or promotion is done.
<55> Section 3.3.5.10: Windows-based servers attempt to maintain the desired number of backup browser servers as 1 backup browser for every 32 servers in the Servers List.
<56> Section 3.3.5.10: When Windows-based clients and servers ignore the command, this bit is set.
<57> Section 3.3.6: Windows Server 2003 uses the time-out value of 12 minutes. Windows 98, Windows Millennium Edition, and Windows 2000 use the following time-out values.
|
LocalMasterAnnouncement timer count value |
New LocalMasterAnnouncement timer value |
|---|---|
|
1 |
4 minutes |
|
2 |
8 minutes |
|
> 2 |
12 minutes |
Windows 7 operating system and later and Windows Server 2008 R2 operating system and later use the following time-out values.
|
LocalMasterAnnouncement timer count value |
New LocalMasterAnnouncement timer value |
|---|---|
|
1 |
2 minutes |
|
2 |
4 minutes |
|
3 |
8 minutes |
|
4 |
12 minutes |
|
> 4 |
12 minutes |
<58> Section 3.3.6: Servers lists and machine groups lists are merged alphabetically.
<59> Section 3.3.6: Windows-based servers use an internal notification API instead of a timer.
<60> Section 3.3.6: Windows-based servers will set IsDomainController to TRUE if the MaintainServerList registry key is set to "Yes".
<61> Section 3.3.6: Windows-based servers use an internal notification API instead of a timer.
<62> Section 3.3.7: Windows-based servers might not send the HostAnnouncement or RequestElection on shutdown as the shutdown process disconnects the network before the browser sends HostAnnouncement or RequestElection frame.
<63> Section 3.4: WINS maintains a set of up to 25 addresses for the <domain>[0x1C] group address.