Mention NetBIOS in a room full of system admins, and a cold draft seems to spread through the room. It’s as they could sense Darth Vader nearby.
I finally decided to get to the bottom of this discomfort. It turns out that NetBIOS’ null sessions have much to answer for. What follows is a compendium of links that explains the problem.
How to secure a box with NetBIOS enabled: Restrict anonymous enumeration
A quick summary
The NetBIOS component’s security holes have been patched by Microsoft. But the default installation of NetBIOS leaves much to be secured. By default, it’s possible to connect anonymously to the IPC$ share on a machine. Once connected, the NetBIOS Session Service can be queried for a complete list of users. The harddrives are shared by default for administrative purposes as c$ and d$. These shares are hidden, but can be accessed by someone with valid credentials. Armed with a knowledge of all usernames on the machine, it’s possible to guess the password of some user with admin rights by a brute force attack on one of the harddrive shares, and after authenticating successfully proceed to wreak havoc.
Some of the links above describe steps to secure NetBIOS. But most recommend that if it is not needed, it’s best to disable it.