Registration of NetBIOS Names

Posted on January 8, 2009 by Daniel Petri in Networking with 0 Comments

MS KB 119495 article  has more info:

Names registered by the WINS server can be divided into three groups:

  1. Computer Name

  2. Domain Name

  3. Other/Special Names

Each WINS Client actually registers its name with the WINS Server three or four times. Note: The MS-DOS clients that ship with Windows NT version 3.5 (LAN Manager version 2.2c client for MS-DOS and Microsoft Network Client version 3.0) provide support for WINS resolution, but not registration.

Several special NetBIOS names are also registered to maintain and retrieve browse lists. Names listed here are indicated by "Name(xx)" name followed by the hex value (xx) and padded with spaces to the 16th byte.

Registered Computer Names:

”<computer_name>[00h] This name is registered for the WINS Client Workstation name.

”<computer_name>[03h] This name is registered for the Messenger Service on the WINS.


”<computer_name>[BFh] Network monitoring utility (group name, registered when running netmon) This name is registered for the Network Monitoring Agent service and will only appear if the service is started on the system. If the computer name is not a full 15 characters, the name will be padded with plus (+) symbols.

”<computer_name>[BEh] Network monitoring agent (unique name, registered when remote agent is started)

”<computer_name>[1Fh] This name is registered for the Network Dynamic Data Exchange (NetDDE) services and will only appear if the NetDDE services are started on the system. By default, under Windows NT version 3.5, the NetDDE services are not automatically started.

”<computer_name>[20h] This name is registered for the Server Service on the WINS Client.

”<computer_name>[21h] RAS client.

”<computer_name>[06h] RAS server service.

Registered Domain Names:

”<domain_name>[00h] This instance of the domain name is registered by the Workstation so that it can receive browser broadcasts from LAN Manager-based systems. This is the name to which server announcements are broadcast in Microsoft LAN Manager so that other Microsoft LAN Manager computers can track the servers on the network. Windows computers do not make these broadcasts unless the LMAnnounce option has been enabled by configuring the Server service in the Control Panel/Networks application.

”<domain_name>[1Bh] This instance of the domain name is registered by the Windows NT Server system that is running as the Domain Master Browser and is used to allow remote browsing of domains. When a WINS Server is queried for this name, a WINS Server returns the IP address of the system that registered this name.

”<domain_name>[1Ch] This name is registered for use by the domain controllers within the domain and can contain up to 25 IP addresses. One IP address will be that of the Primary Domain Controller (PDC) and the other 24 will be the IP addresses of Backup Domain Controllers (BDCs). The [1Ch] domain name is used by the BDCs to locate the PDC and is used when pass- through authentication is needed to validate a logon request.

”<domain_name>[1Dh] This instance of the domain name is registered only by the Master Browser, of which there can only be one for the domain. This name is used by the Backup Browsers to communicate with the Master Browser in order to retrieve the list of available servers from the Master Browser.

”<domain_name>[1Eh] This name is registered by all Browser servers and Potential Browser servers in a domain or workgroup. It is used for announcement requests which are sent by Master Browsers to fill up its browse lists, and for election request packets to force an election.

Other/Special Names:

In addition to computer names and domain names, the following names also appear in the WINS database.

”–__MSBROWSE__[01h] This name is registered by the Master Browser and is used to broadcast and receive domain announcements on the local subnet. It is through this name that Master Browsers for different domains learn the names of different domains and the names of the Master Browsers on those domains. When a WINS Server receives a name query for this name, the WINS Server will always return the subnet broadcast address for the requesting client’s local subnet.

”<username>[03h] When viewing the WINS database, the usernames for the currently logged on users will also be registered in the WINS database. The username is registered by the Server component so that the user can receive any ‘net send’ commands sent to their username.

The complete NetBIOS name list

Here is the complete list of NetBIOS names:

Name Number Type Usage
<computername> 00 U Workstation Service
<computername> 01 U Messenger Service
<”_MSBROWSE_> 01 G Master Browser
<computername> 03 U Messenger Service
<computername> 06 U RAS Server Service
<computername> 1F U NetDDE Service
<computername> 20 U File Server Service
<computername> 21 U RAS Client Service
<computername> 22 U Exchange Interchange
<computername> 23 U Exchange Store
<computername> 24 U Exchange Directory
<computername> 30 U Modem Sharing Server Service
<computername> 31 U Modem Sharing Client Service
<computername> 43 U SMS Client Remote Control
<computername> 44 U SMS Admin Remote Control Tool
<computername> 45 U SMS Client Remote Chat
<computername> 46 U SMS Client Remote Transfer
<computername> 4C U DEC Pathworks TCPIP Service
<computername> 52 U DEC Pathworks TCPIP Service
<computername> 87 U Exchange MTA
<computername> 6A U Exchange IMC
<computername> BE U Network Monitor Agent
<computername> BF U Network Monitor Apps
<username> 03 U Messenger Service
<domain> 00 G Domain Name
<domain> 1B U Domain Master Browser
<domain> 1C G Domain Controllers
<domain> 1D U Master Browser
<domain> 1E G Browser Service Elections
<INet~Services> 1C G Internet Information Server
<IS~Computer_name> 00 U Internet Information Server
<computername> [2B] U Lotus Notes Server
Forte_$ND800ZA [20] U DCA Irmalan Gateway Service


Unique (U): The name may have only one IP address assigned to it. On a network device, multiple occurences of a single name may appear to be registered, but the suffix will be unique, making the entire name unique.

Group (G): A normal group; the single name may exist with many IP addresses.

Multihomed (M): The name is unique, but due to multiple network interfaces on the same computer, this configuration is necessary to permit the registration. Maximum number of addresses is 25.

Internet Group (I): This is a special configuration of the group name used to manage WinNT domain names.

Related articles

You may find these related articles of interest to you:


List of Names Registered with WINS Service – 119495



A List of Names That Are Registered by Windows Internet Naming Service – 314104