Detections
Analytics

69.3 (L1) Ensure 'Computer Browser (Browser)' is set to 'Disabled' or 'Not Installed'

Information

Maintains an updated list of computers on the network and supplies this list to computers designated as browsers.

The recommended state for this setting is: Disabled or Not Installed

Note: In Windows 8.1 and Windows 10, this service is bundled with the

SMB 1.0/CIFS File Sharing Support

optional feature. As a result, removing that feature (highly recommended unless backward compatibility is needed to XP/2003 and older Windows OSes - see

Stop using SMB1 | Storage at Microsoft

) will also remediate this recommendation. The feature is not installed by default starting with Windows 10 R1709.

This is a legacy service - its sole purpose is to maintain a list of computers and their network shares in the environment (i.e. 'Network Neighborhood'). If enabled, it generates a lot of unnecessary traffic, including 'elections' to see who gets to be the 'master browser'. This noisy traffic could also aid malicious attackers in discovering online machines, because the service also allows anyone to 'browse' for shared resources without any authentication. This service used to be running by default in older Windows versions (e.g. Windows XP), but today it only remains for backward compatibility for very old software that requires it.

Solution

To establish the recommended configuration, set the following Custom Configuration Policy to 4 or confirm that the service is Not installed :

Name: <Enter name>
Description: <Enter Description>
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/SystemServices/ConfigureComputerBrowserServiceStartupMode
Data Type: Integer
Value: 4

Note: As of January 2024, despite its inclusion in Microsoft's official documentation, using an OMI-URI to configure a Windows Service Startup Mode via a custom profile will lead to an error in Intune. This error will be logged in the local event log as 'The system cannot find the file specified.' Currently, the most reliable method for remediation is through PowerShell.

The recommended configuration can also be established via PowerShell, by running the following cmdlet:

if(Test-Path -LiteralPath 'HKLM:\SYSTEM\CurrentControlSet\Services\Browser') {
 Set-ItemProperty -LiteralPath 'HKLM:\SYSTEM\CurrentControlSet\Services\Browser' -Name 'Start' -Value 4 -Verbose
}

Note: This service is not installed in Windows 10 R1709 and newer. Running the cmdlet Set-Service -Name 'Browser' -StartupType Disabled will cause a inadvertent match against a similarly named service called bowser which coincidentally has the DisplayName of Browser and will then throw an error. bowser is actually the NT Lan Manager Datagram Receiver Driver Using the literal registry path above avoids that error.

Impact:

The list of computers and their shares on the network will not be updated or maintained.

See Also

https://workbench.cisecurity.org/benchmarks/16853

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Windows

Control ID: 8f38ca4e96a172c5d6024d64cb883b2bbea6b732e44911412e4f3a4adc8d703b