6 Appendix A: Product Behavior
The information in this specification is applicable to the following Microsoft products or supplemental software. References to product versions include updates to those products.
Windows NT operating system
Windows 2000 operating system
Windows XP operating system
Windows Server 2003 operating system
Windows Vista operating system
Windows Server 2008 operating system
Windows 7 operating system
Windows Server 2008 R2 operating system
Windows 8 operating system
Windows Server 2012 operating system
Windows 8.1 operating system
Windows Server 2012 R2 operating system
Windows 10 operating system
Windows Server 2016 operating system
Windows Server operating system
Windows Server 2019 operating system
Windows Server 2022 operating system
Windows 11 operating system
Windows Server 2025 operating system
Exceptions, if any, are noted in this section. If an update version, service pack or Knowledge Base (KB) number appears with a product name, the behavior changed in that update. The new behavior also applies to subsequent updates unless otherwise specified. If a product edition appears with the product version, behavior is different in that product edition.
Unless otherwise specified, any statement of optional behavior in this specification that is prescribed using the terms "SHOULD" or "SHOULD NOT" implies product behavior in accordance with the SHOULD or SHOULD NOT prescription. Unless otherwise specified, the term "MAY" implies that the product does not follow the prescription.
<1> Section 1.8: Unless a protocol using the recommended convention specifies otherwise, Windows protocols use the machine system code page for NetBIOS names; this means that two computers with different code pages cannot interoperate by using such a protocol with anything other than ASCII names.
<2> Section 1.8: Some common NetBIOS suffix values used by Windows NT and Windows 2000 are as follows.
All NetBIOS names are 16
characters in length. A NetBIOS suffix is the 16th character of the
16-character NetBIOS name. The NetBIOS suffix is used by Microsoft Networking
software to identify functionality installed on the registered device.
The following table lists the NetBIOS suffixes that are used by Microsoft
Windows NT. The suffixes are listed in hexadecimal format because many of them
are unprintable otherwise.
|
Name |
Number |
Type |
Usage |
|---|---|---|---|
|
<computername> |
00 |
U |
Workstation Service |
|
<computername> |
01 |
U |
Messenger Service |
|
<\\--__MSBROWSE__> |
01 |
G |
Master Browser |
|
<computername> |
03 |
U |
Messenger Service |
|
<computername> |
06 |
U |
RAS Server Service |
|
<computername> |
1F |
U |
NetDDE Service |
|
<computername> |
20 |
U |
File Server Service |
|
<computername> |
21 |
U |
RAS Client Service |
|
<computername> |
22 |
U |
Microsoft Exchange Server Interchange (MSMail Connector) |
|
<computername> |
23 |
U |
Microsoft Exchange Store |
|
<computername> |
24 |
U |
Microsoft Exchange Directory |
|
<computername> |
30 |
U |
Modem Sharing Server Service |
|
<computername> |
31 |
U |
Modem Sharing Client Service |
|
<computername> |
43 |
U |
SMS Clients Remote Control |
|
<computername> |
44 |
U |
SMS Administrators Remote Control Tool |
|
<computername> |
45 |
U |
SMS Clients Remote Chat |
|
<computername> |
46 |
U |
SMS Clients Remote Transfer |
|
<computername> |
4C |
U |
DEC Pathworks TCPIP service on Windows NT |
|
<computername> |
42 |
U |
mcafee anti-virus |
|
<computername> |
52 |
U |
DEC Pathworks TCPIP service on Windows NT |
|
<computername> |
87 |
U |
Microsoft Exchange MTA |
|
<computername> |
6A |
U |
Microsoft Exchange IMC |
|
<computername> |
BE |
U |
Network Monitor Agent |
|
<computername> |
BF |
U |
Network Monitor Application |
|
<username> |
03 |
U |
Messenger Service |
|
<domain> |
00 |
G |
Domain Name |
|
<domain> |
1B |
U |
Domain Master Browser |
|
<domain> |
1C |
G |
Domain Controllers |
|
<domain> |
1D |
U |
Master Browser |
|
<domain> |
1E |
G |
Browser Service Elections |
|
<INet~Services> |
1C |
G |
Internet Information Services (IIS) |
|
<IS~computer name> |
00 |
U |
IIS |
|
<computername> |
[2B] |
U |
Lotus Notes Server Service |
|
IRISMULTICAST |
[2F] |
G |
Lotus Notes |
|
IRISNAMESERVER |
[33] |
G |
Lotus Notes |
|
Forte_$ND800ZA |
[20] |
U |
DCA IrmaLan Gateway Server Service |
Unique (U): The name may have only one IP address assigned to it. On a network
device multiple occurrences of a single name may appear to be registered. The
suffix may be the only unique character in the name.
Group (G): A normal group; the single name may exist with many IP addresses. WINS responds to a name
query on a group name with the limited broadcast address (255.255.255.255).
Because routers block the transmission of these addresses, the Internet Group
was designed to service communications between subnets.
Multihomed (M): The name is unique, but due to multiple network interfaces on
the same computer this configuration is necessary to permit the registration.
The maximum number of addresses is 25.
Internet Group (I): This is a special configuration of the group name used to
manage Windows NT Domain names.
Domain Name (D): New in Windows NT 4.0.
WINS and DNS
Windows Internet Name Service (WINS) and Domain Name System (DNS) are both name resolution
services for TCP/IP networks. While WINS resolves names in the NetBIOS
namespace to IPv4 addresses, DNS resolves names in the DNS domain namespace to
IPv6 addresses. WINS primarily supports clients that run older versions of
Windows and applications that use NetBIOS. Windows 2000, Windows XP, and
Windows Server 2003 use DNS names in addition to NetBIOS names. Environments
that include some computers that use NetBIOS names and other computers that use
domain names must include both WINS servers and DNS servers.
For more information on WINS see [MS-WINSRA], [MS-RAIW], and [MSDOCS-WINS].
<3> Section 1.8: The following NetBIOS names reference applies to Windows Server 2003, Windows Server 2003 R2 operating system, Windows Server 2008, Windows Server 2008 R2, and Windows Server 2012 operating system.
For all Microsoft operating systems that support and use NetBIOS names, the first 15 characters of a name can be specified by a user. However, the 16th character of the name (00-FF hex) always indicates a resource type.
This section contains additional information and examples of NetBIOS names used by Microsoft networking components.
NetBIOS name type overview
The following are the most common types of NetBIOS names that can be used in the WINS database. When creating static mappings, these general types are available for selected use.
|
Type |
Description |
|---|---|
|
Unique (U) |
Used to associate the computer specified by name in Computer name and a single IP address in IP address for this static mapped entry. When this type is selected, three types of records are statically added to the WINS database for the specified computer name. These are the [00h]WorkStation, [03h]Messenger, and [20h] File Server types. |
|
Group (G) |
Also referred to as a normal group. This type is used to add a static entry for the computer, specified by name in a static mapping, to a workgroup used on your network. If this type is used, the IP address for the computer is not stored in WINS but is resolved through local subnet broadcasts. |
|
Domain Name (D) |
Indicates a domain name [1C] mapped entry for locating Windows NT domain controllers. |
|
Internet Group (I) |
Used for special user-defined administrative groups. You can use this to group resources. For example, you can indicate a group of file or print servers for organizing shared resources that are visible when browsing your network places. Each Internet group is represented by a shared group name of [20h] type in the WINS database. |
|
Multihomed (M) |
Used to register a unique name for a computer that has more than one IP address (either multiple adapters each using a single address or one network adapter configured with multiple IP addresses). |
NetBIOS Unique Names are for computers or users
|
Format |
Description |
|---|---|
|
computer_name[00h] |
Registered by the Workstation Service on the WINS client. In general, this name is called the NetBIOS computer name. |
|
computer_name[03h] |
Registered by the Messenger service on the WINS client. This service is used by the client when sending and receiving messages. This name is usually appended to both the NetBIOS computer name for the WINS client computer and the name of the user currently logged on to that computer when sending messages on the network. |
|
computer_name[06h] |
Registered by the Routing and Remote Access service on the WINS client (when the service is started). |
|
domain_name[1Bh] |
Registered by each Windows NT Server 4.0 operating system domain controller running as the domain master browser. This name record is used to allow remote browsing of domains. When a WINS server is queried for this name, a WINS server returns the IP address of the computer that registered this name. |
|
computer_name[1Fh] |
Registered by the Network Dynamic Data Exchange (NetDDE) services. This appears only if the NetDDE services are started on the computer. |
|
computer_name[20h] |
Registered by the Server service on the WINS client. This service is used to provide points of service to the WINS client to provide sharing of its files on the network. |
|
computer_name[21h] |
Registered by the RAS Client service on the WINS client (when the RAS Client is started). |
|
computer_name[BEh] |
Registered by the Network Monitoring Agent Service and appearing only if the service is started on the WINS client computer. If the computer name has fewer than 15 characters, the remaining character spaces are padded with plus (+) symbols. |
|
computer_name[BFh] |
Registered by the Network Monitoring Utility (included with Microsoft Systems Management Server). If the computer name has fewer than 15 characters, the remaining character spaces are padded with plus (+) symbols. |
|
username[03h] |
Usernames for currently logged-on users are registered in the WINS database. Each username is registered by the Server service component so that users can receive any net send commands sent to the username. If more than one user logs on with the same username, only the first computer logged on with that name registers the name. |
NetBIOS Group Names are for domains, groups, or the master browser.
|
Format |
Description |
|---|---|
|
domain_name[00h] |
Registered by the Workstation Service so that it can receive browser broadcasts from LAN Manager-based computers. |
|
domain_name[1Ch] |
Registered for use by the domain controllers within the domain. These contain up to 25 IP addresses. |
|
domain_name[1Dh] |
Registered for use by master browsers, of which there is only one per subnet. Backup browsers use this name to communicate with the master browser, retrieving the list of available servers from the master browser. WINS servers always return a positive registration response for domain_name[1D], even though the WINS server does not register this name in its database. Therefore, when a WINS server is queried for the domain_name[1D], the WINS server returns a negative response, which forces the client to broadcast for name resolution. |
|
group_name[1Eh] |
A normal group name. Any computers configured to be network browsers can broadcast to this name, and listen for broadcasts to this name, to elect a master browser. A statically mapped group name uses this name to register itself on the network. When a WINS server receives a name query for a name ending with [1E], the WINS server always returns the network broadcast address for the local network of the requesting client. The client can then use this address to broadcast to the group members. These broadcasts are for the local subnet and should not cross routers. |
|
group_name[20h] |
A special group name called the Internet Group is registered with WINS servers to identify groups of computers for administrative purposes. For example, "printersg" could be a registered group name used to identify an administrative group of print servers. |
|
--__MSBROWSE__[01h] |
Registered by the master browser for each subnet. When a WINS server receives a name query for this name, the WINS server always returns the network broadcast address for local network of the requesting client. |
<4> Section 2.2.1: Windows 2000, Windows XP, and Windows Server 2003 allow the SMB protocol to add the name "*SMBSERVER" to the Local Name Table.
<5> Section 2.2.3: In Windows, this file is in the systemroot\System32\Drivers\Etc folder.
<6> Section 3.1.1: In Windows NT, Windows 2000, Windows XP, and Windows Server 2003, the default setting is TRUE.
<7> Section 3.1.3: When a DHCP option is received, Windows stores the value in its Node Type, so that the most recent one received is the one used for subsequent operations.
<8> Section 3.1.3: In Windows, except Windows NT, Windows 2000, Windows XP, and Windows Server 2003 the read is from the registry using HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\ReadLMHostsFile if the key exists. A value of 1 means ReadLMHostsFile will be set to TRUE. If the key is not present in the registry the value of ReadLMHostsFile does not change.
<9> Section 3.1.3: In Windows because no user name is associated with the computer during startup, NBT uses a null user name for its credentials when accessing the shared folder where the central LMHOSTS file is located.
<10> Section 3.1.3: To allow null access to a shared folder that contains an LMHOSTS file on a Windows machine, the name of the folder can be set to the registry value of HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet \Services\Lanmanserver \Parameters\NullSessionShares.
<11> Section 3.2.5.1: If the last byte of the group name is not 0x1C, Windows follows the RFC behavior of replacing addresses. For group names with the last byte equal to 0x1C, Windows appends addresses. For any group names except those with a last byte of 0x1C, Windows returns 255.255.255.255 in response to queries as if it had stored 255.255.255.255.