I have a Windows Server that has all ports blocked except the ones i need. I did a PCI scan today and saw that I have a port open on port 2255 which caught my attention.
So I did actually navigated to the port by my browser
http://my-ip:2255 and this is what came up:
220 . 530 Not logged in. 530 Not logged in. 530 Not logged in. 530 Not logged in. 530 Not logged in. 331 eVolite Team User name okay, need password. 530 Not logged in. 530 Not logged in. 530 Not logged in. 421 Maximum session time exceeded - closing.
After scratching my head trying to figure out what the heck it was, I logged into the server and did a netstat -ab and found that the port is being listened to by the process [tcpsrv.exe]. I ran process explorer and see there is a service running called "TCP/IP NetBIOS" that runs that process. The startup type of the service is "Disabled" but the status is "Started". So when i go to stop the service, i get a warning that the following services "Workstation" and "Server" are dependant on this service, and if i stop "TCP/IP NetBIOS" those will stop too. From my understanding, the two dependants, if they are stopped, it will prevent my from remoting in to the server.
Does anyone know if its 'safe' to disable this service? I don't have physical access to the server, I can only RDP in (its co-located). Any info would be greately apprecaited.
Start Free Trial
