NetBIOS Node Type: Killing NBT-NS Poisoning at the Resolver

Every Windows security team knows the LLMNR/NBT-NS poisoning story: an attacker on your LAN runs Responder or Inveigh, waits for a machine to broadcast a name lookup for a host that does not resolve cleanly, answers "that's me," and walks away with an NTLMv2 hash or a relayed authentication. The usual advice is "disable LLMNR and disable NetBIOS over TCP/IP." That advice is correct — but the NetBIOS half is almost always applied at the wrong layer, and the stronger control gets skipped.

Two levers, not one

There are two independent knobs that govern whether a Windows host will broadcast a NetBIOS name query onto the local segment:

• Per-adapter NetBIOS over TCP/IP — the TcpipNetbiosOptions setting you reach through the adapter's IPv4 → Advanced → WINS tab (or via SetTcpipNetbios(2)). This disables NBT on that adapter.
• The NetBIOS node type — a machine-wide setting that controls how the NBT resolver resolves names on every adapter where NBT is still active.

Most hardening guides only mention the first. But the per-adapter toggle has to be re-applied to every NIC, is easy to miss on a newly added interface, and quietly comes back on adapters provisioned by DHCP. The node type is a single value that changes the resolver's behaviour everywhere at once.

What the node type actually does

When NBT is active, the node type decides the resolution strategy. The Windows values are:

• 1 — B-node (broadcast): resolve names purely by broadcasting to the local subnet.
• 4 — M-node (mixed): broadcast first, then fall back to WINS.
• 8 — H-node (hybrid): try WINS first, then fall back to broadcast. This is the Windows default when a WINS server is configured — and it still broadcasts.
• 2 — P-node (point-to-point): resolve via WINS only. Never broadcasts.

Read that again: B-node, M-node, and the default H-node all put a broadcast NetBIOS name query on the wire under the right conditions. That broadcast is exactly the packet Responder and Inveigh are listening for. Only P-node removes the broadcast behaviour from the resolver itself — no matter how many adapters exist or how they were provisioned.

Disabling NBT per-adapter removes the surface on the adapters you remembered. Setting the node type to P-node removes the broadcast behaviour from the resolver, so a forgotten or freshly-added adapter can't reintroduce it.

The setting

The node type lives in the registry under the NBT driver's parameters:

HKLM\SYSTEM\CurrentControlSet\Services\Netbt\Parameters\NodeType

When an explicit NodeType is absent, Windows falls back to the DHCP-supplied DhcpNodeType (option 46) — which is why a host with no local override can silently sit on H-node handed out by DHCP. To force point-to-point (WINS-only, no broadcast) machine-wide:

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Netbt\Parameters' -Name NodeType -Value 2

The NBT driver reads this at start-up, so reboot after changing it. One caveat: P-node means the host will only use WINS for NetBIOS name resolution. If you still depend on NetBIOS name resolution and have no WINS infrastructure, the cleaner end state is to disable NetBIOS over TCP/IP entirely rather than force P-node. On a modern network that no longer needs NetBIOS at all, disabling NBT is the strongest option; P-node is the right control when NBT must stay on but broadcast must go.

Where it fits in the name-resolution picture

Broadcast NetBIOS name resolution is one of a family of local name-resolution poisoning vectors, and hardening all of them is what actually shuts Responder down:

• LLMNR — disable via the EnableMulticast = 0 DNS Client policy.
• NBT-NS broadcast — disable NBT per adapter and set the node type to P-node.
• mDNS — disable via EnableMDNS = 0 on the DNS cache service.
• WPAD — set the DisableWpad = 1 kill switch so the "wpad" proxy lookup can't be poisoned.
• NetBIOS name-release — set NoNameReleaseOnDemand = 1 so an attacker can't forge a name-release datagram and hijack your registered name.

Miss one and Responder still has a path. The node type is the piece that most checklists leave out — the broadcast is still happening even after "NetBIOS is disabled" because it was only disabled on some adapters, or because the default H-node was never changed.

WinSentinel audits it

WinSentinel's Network Posture audit now grades the NetBIOS node type alongside the LLMNR, NBT-NS, WPAD, mDNS, and name-release checks. It reads NodeType (falling back to the DHCP-supplied DhcpNodeType), and:

• Passes only on P-node (NodeType = 2) — WINS only, no broadcast.
• Warns on any broadcast-capable node type (B/M/H-node) or when the value is absent, because the Windows default still broadcasts.
• Fails safe — if the value can't be read, it surfaces the exposure rather than hiding it.

The finding ships a one-line, elevation-ready fix so you can go from "flagged" to "hardened" without hand-editing the registry. It's part of the free, single-machine audit — no license required. Run winsentinel --audit and check the Network section: if your node type isn't P-node, Responder still has a broadcast to answer.