Registration of NetBIOS Names
MS KB 119495 article has more info:
Names registered by the WINS server can be divided into three groups:
Each WINS Client actually registers its name with the WINS Server three or four times. Note: The MS-DOS clients that ship with Windows NT version 3.5 (LAN Manager version 2.2c client for MS-DOS and Microsoft Network Client version 3.0) provide support for WINS resolution, but not registration.
Several special NetBIOS names are also registered to maintain and retrieve browse lists. Names listed here are indicated by "Name(xx)" name followed by the hex value (xx) and padded with spaces to the 16th byte.
Registered Computer Names:
”<computer_name>[00h] This name is registered for the WINS Client Workstation name.
”<computer_name>[03h] This name is registered for the Messenger Service on the WINS.
”<computer_name>[BFh] Network monitoring utility (group name, registered when running netmon) This name is registered for the Network Monitoring Agent service and will only appear if the service is started on the system. If the computer name is not a full 15 characters, the name will be padded with plus (+) symbols.
”<computer_name>[BEh] Network monitoring agent (unique name, registered when remote agent is started)
”<computer_name>[1Fh] This name is registered for the Network Dynamic Data Exchange (NetDDE) services and will only appear if the NetDDE services are started on the system. By default, under Windows NT version 3.5, the NetDDE services are not automatically started.
”<computer_name>[20h] This name is registered for the Server Service on the WINS Client.
”<computer_name>[21h] RAS client.
”<computer_name>[06h] RAS server service.
Registered Domain Names:
”<domain_name>[00h] This instance of the domain name is registered by the Workstation so that it can receive browser broadcasts from LAN Manager-based systems. This is the name to which server announcements are broadcast in Microsoft LAN Manager so that other Microsoft LAN Manager computers can track the servers on the network. Windows computers do not make these broadcasts unless the LMAnnounce option has been enabled by configuring the Server service in the Control Panel/Networks application.
”<domain_name>[1Bh] This instance of the domain name is registered by the Windows NT Server system that is running as the Domain Master Browser and is used to allow remote browsing of domains. When a WINS Server is queried for this name, a WINS Server returns the IP address of the system that registered this name.
”<domain_name>[1Ch] This name is registered for use by the domain controllers within the domain and can contain up to 25 IP addresses. One IP address will be that of the Primary Domain Controller (PDC) and the other 24 will be the IP addresses of Backup Domain Controllers (BDCs). The [1Ch] domain name is used by the BDCs to locate the PDC and is used when pass- through authentication is needed to validate a logon request.
”<domain_name>[1Dh] This instance of the domain name is registered only by the Master Browser, of which there can only be one for the domain. This name is used by the Backup Browsers to communicate with the Master Browser in order to retrieve the list of available servers from the Master Browser.
”<domain_name>[1Eh] This name is registered by all Browser servers and Potential Browser servers in a domain or workgroup. It is used for announcement requests which are sent by Master Browsers to fill up its browse lists, and for election request packets to force an election.
In addition to computer names and domain names, the following names also appear in the WINS database.
”–__MSBROWSE__[01h] This name is registered by the Master Browser and is used to broadcast and receive domain announcements on the local subnet. It is through this name that Master Browsers for different domains learn the names of different domains and the names of the Master Browsers on those domains. When a WINS Server receives a name query for this name, the WINS Server will always return the subnet broadcast address for the requesting client’s local subnet.
”<username>[03h] When viewing the WINS database, the usernames for the currently logged on users will also be registered in the WINS database. The username is registered by the Server component so that the user can receive any ‘net send’ commands sent to their username.
The complete NetBIOS name list
Here is the complete list of NetBIOS names:
|<computername>||06||U||RAS Server Service|
|<computername>||20||U||File Server Service|
|<computername>||21||U||RAS Client Service|
|<computername>||30||U||Modem Sharing Server Service|
|<computername>||31||U||Modem Sharing Client Service|
|<computername>||43||U||SMS Client Remote Control|
|<computername>||44||U||SMS Admin Remote Control Tool|
|<computername>||45||U||SMS Client Remote Chat|
|<computername>||46||U||SMS Client Remote Transfer|
|<computername>||4C||U||DEC Pathworks TCPIP Service|
|<computername>||52||U||DEC Pathworks TCPIP Service|
|<computername>||BE||U||Network Monitor Agent|
|<computername>||BF||U||Network Monitor Apps|
|<domain>||1B||U||Domain Master Browser|
|<domain>||1E||G||Browser Service Elections|
|<INet~Services>||1C||G||Internet Information Server|
|<IS~Computer_name>||00||U||Internet Information Server|
|<computername>||[2B]||U||Lotus Notes Server|
|Forte_$ND800ZA||||U||DCA Irmalan Gateway Service|
Unique (U): The name may have only one IP address assigned to it. On a network device, multiple occurences of a single name may appear to be registered, but the suffix will be unique, making the entire name unique.
Group (G): A normal group; the single name may exist with many IP addresses.
Multihomed (M): The name is unique, but due to multiple network interfaces on the same computer, this configuration is necessary to permit the registration. Maximum number of addresses is 25.
Internet Group (I): This is a special configuration of the group name used to manage WinNT domain names.
You may find these related articles of interest to you: