Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My workgroup Windows XP Pro SP3 permits (or establishes itself) a hundred of network sessions with workgroup computers, see the result of "net sessions" below [1]. NetBT (NetBIOS over TCP/IP) is disabled.

I tried to detect which service is responsible for it by disabling one service by one in services.msc, then disabling/enabling my NIC network connection, checking (by netstat -a and net view) after each disabling that sessions were being reestablished (after restarting network connection, the session list [2] is empty and then is filled up). See the list of services I disabled in [2].

After rebooting the local workgroup sessions stopped reappearing in the "net session" [1] and netstat list.

What is/are service(s) responsible for establishing sessions with workgrup computers?

Why did rebooting stopped recovering of sessions but disabling/enabling of NIC network connection NOT?!

Sure, I could have run "netstat -nb", showing executables involved in connection creation, but the names of system dll/exe do not tell me much. Anyway, what should I do - r-enable all services back and reboot computer just to see "netstat -nb" or what?

----------

[2] Disabled services:

  • Acronis Scheduler Service
  • Computer Browser
  • Fast User Switching
  • Human Interface Device Access
  • Peer Name Resolution Protocol
  • Peer Networking
  • Peer Networking Group Authentication
  • Peer Networking Identity Manager
  • Print Spooler
  • Remote Access Auto Connection Manager
  • Remote Access Connection Manager
  • Remote Desktop Help Session Manager
  • RIP Listener
  • Routing and Remote Access
  • Secondary Logon
  • TCP/IP NetBIOS Helper
  • Universal Plug and Play Device Host

[1]

D:\Documents and Settings\Administrator>net sessions

Computer               User name            Client Type       Opens Idle time
------------------------------------------------------------------------------
\\10.204.27.14                              Windows 2000 2195     1 07:07:29
\\10.204.27.14                              Windows 2000 2195     1 04:52:29
\\10.204.27.14                              Windows 2000 2195     1 04:19:29
\\10.204.27.14                              Windows 2000 2195     1 06:16:29
\\10.204.39.50                              Windows 2000 2195     1 00:10:29
\\10.204.43.23                              Windows 2000 2195     1 05:37:29
\\10.204.43.23                              Windows 2000 2195     1 05:04:29
\\10.204.43.23                              Windows 2000 2195     1 00:04:29
\\10.204.43.23                              Windows 2000 2195     1 01:37:29
\\10.204.43.23                              Windows 2000 2195     1 04:28:29
\\10.204.43.23                              Windows 2000 2195     1 01:10:29
\\10.204.43.23                              Windows 2000 2195     1 01:07:29
\\10.204.43.23                              Windows 2000 2195     1 02:16:29
\\10.204.43.23                              Windows 2000 2195     1 03:55:29
\\10.204.43.23                              Windows 2000 2195     1 02:49:29
\\10.204.43.23                              Windows 2000 2195     1 03:22:29
\\10.204.45.102                             Windows 2000 2195     1 03:01:29
\\10.204.45.102                             Windows 2000 2195     1 03:31:29
\\10.204.52.121                             Windows 2000 2195     1 01:34:29
\\10.204.55.88                              Windows 2000 2195     1 00:25:29
\\10.204.56.25                              Windows 2000 2195     1 02:37:29
\\10.204.56.25                              Windows 2000 2195     1 04:19:29
\\10.204.56.25                              Windows 2000 2195     1 02:04:29
\\10.204.56.25                              Windows 2000 2195     1 04:52:29
\\10.204.56.25                              Windows 2000 2195     1 03:13:29
\\10.204.56.25                              Windows 2000 2195     1 01:25:29
\\10.204.56.25                              Windows 2000 2195     1 05:25:29
\\10.204.56.25                              Windows 2000 2195     1 06:31:29
\\10.204.56.25                              Windows 2000 2195     1 07:04:29
\\10.204.56.25                              Windows 2000 2195     1 06:55:29
\\10.204.56.25                              Windows 2000 2195     1 00:25:29
\\10.204.56.25                              Windows 2000 2195     1 03:46:29
\\10.204.57.105                             Windows 2000 2195     1 00:16:29
\\10.204.57.105                             Windows 2000 2195     1 00:10:29
\\10.204.57.105                             Windows 2000 2195     1 00:34:29
\\10.204.57.105                             Windows 2000 2195     1 00:04:29
\\10.204.57.105                             Windows 2000 2195     1 00:40:29
\\10.204.57.105                             Windows 2000 2195     1 00:01:29
\\10.204.57.105                             Windows 2000 2195     1 00:25:29
The command completed successfully.
share|improve this question

2 Answers 2

The "net session" command shows incoming connections (sessions established TO your machine). The Server service is responsible for advertising and allowing these incoming connections. Shared files and printers will make use of the Server service. NetBIOS over TCP\IP isn't required for file and printer sharing to work so disabling it isn't going to stop these incoming connections. Do you have shared folders or printers on your machine?

share|improve this answer
    
No, I have no shared folders. And why, then,workgroup computers stopped establishing sessions on my computer adter I disabled those (which one of them?) services? –  Gennady Vanin Novosibirsk Aug 12 '10 at 15:39
    
If you disabled the Server service then that would prevent other machines from making those types of connections to your machine. –  joeqwerty Aug 12 '10 at 23:18
    
No, I did not disable Server service! see thу list of services I provided –  Gennady Vanin Novosibirsk Aug 13 '10 at 7:05

If you're looking to turn the output from netstat -nb into something useful, the "Process Explorer" tool from System Internals (link) is very good at that. Once you've identified the process, you can look it up in Process Explorer, right-click on it to get properties, and the Service it belongs to (if service it is) will be shown.

If it is System[4], then the traffic is part of the operating system in some way. The 'Server' service is one such service that is served out of System[4].

share|improve this answer
    
About "betstat -nb": Have you read last paragraph of my question? "Server service" is running but sessions do not reappear –  Gennady Vanin Novosibirsk Aug 15 '10 at 1:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.