{ "componentChunkName": "component---src-templates-post-js", "path": "/blog/Disable-NetBios", "result": {"data":{"markdownRemark":{"html":"

Disabling NetBios can enhance security by reducing the exposure of your network to potential vulnerabilities and attacks. NetBios is an older protocol that can be exploited by attackers to gain unauthorised access, spread malware, and perform various types of attacks. Disabling it can prevent these risks and help safeguard your network. However, before doing so, ensure that it won't disrupt any legitimate services that rely on NetBios.

\n

To first assess your estate you can deploy the detection script to all devices in your estate. This will identify devices where NetBios is still enabled.

\n

PowerShell

\n
Detect-NetBios.ps1
\n
$Path = \"HKLM:SYSTEM\\CurrentControlSet\\Services\\NetBT\\Parameters\\Interfaces\"\n\n$Interfaces = Get-ChildItem $Path | Select-Object -ExpandProperty PSChildName\n\nforeach($Interface in $Interfaces) {\n    $NetBiosCheck = Get-ItemProperty -path \"$Path\\$Interface\" -Name \"NetbiosOptions\"\n    if ($NetBiosCheck.NetbiosOptions -ne 2) {\n        $Detect = $true\n    }ELSE{\n        $Detect = $false\n    }\n}\n\nif ($Detect) {\n    Write-Warning \"Not Compliant\"\n    Exit 1\n} else {\n    Write-Output \"Compliant\"\n    Exit 0\n}
\n

Intune Configuration

\n

In Intune you will need to got to Devices > Remediations

\n

Select Create Script Package

\n

Enter the Name and add a Description

\n

\n \n \n \n \n

\n

Browse and select the detection and remediation scripts. If you just want to identify devices with NetBios enabled just add a detection script.

\n

\n \n \n \n \n

\n

Apply any scope tags and assign the remditiaion to the users or devices groups you wish to deploy the remediation to.

\n

Disable Script

\n

The disable script checks for the registry key for each interface for the value of the key NetbiosOptions. If NetBios is detected as enabled the Disable-NetBios.ps1 script will loop through all the interfaces and set the value to 2 which will disable NetBios after a system restart.

\n

PowerShell

\n
Disable-NetBios.ps1
\n
$Path = \"HKLM:SYSTEM\\CurrentControlSet\\Services\\NetBT\\Parameters\\Interfaces\"\n\n$Interfaces = Get-ChildItem $Path| Select-Object -ExpandProperty PSChildName\n\nforeach($Interface in $Interfaces) {\n\n    Set-ItemProperty -Path \"$Path\\$Interface\" -Name \"NetbiosOptions\" -Value 2\n\n}
\n

Resources

\n","frontmatter":{"title":"Disable NetBios","description":"A PowerShell script to detect and disable NetBios on all Interfaces.","date":"2023-08-31T00:00:00.000Z","slug":"/blog/Disable-NetBios","tags":["Intune","PowerShell"],"canonical":null}}},"pageContext":{}}, "staticQueryHashes": ["1994492073","2009693873","2031412112","3825832676"]}