WINS of the active connection

Content Authoring
1

(imported topic written by SystemAdmin)

I’m trying to drill down to the WINS settings of the active connections to change them, which I know is located under HKLM\System\CurrentControlSet\Services\NetBT\Parameters\Interfaces\Tcpip_{guid of the adapter}

To obtain the name (guid) of the active adapters, do you guys think I should compare the address of the adapters to the ip interface, or not? I was thinking I woud have to, otherwise I might be modifying the WINS on adapters that wouldn’t neccesarily be active.

Example comparing the adapter to the ip interface…

Q: names of adapters whose (wins enabled of it = true and address of it = address of ip interface whose (loopback of it = false) of network) of network

A: {F840F878-1EF8-4E7D-8DF9-001006A5065B}

T: 3.888 ms

I: plural string

Versus just looking at the adapter where an IP is defined…

Q: names of adapters whose (exists address whose (it as string != “0.0.0.0”) of it and wins enabled of it) of network

A: {F840F878-1EF8-4E7D-8DF9-001006A5065B}

T: 3.734 ms

I: plural string

-Paul

2

(imported comment written by BenKus)

I think the second way is better since the first way will give you errors if you have multiple ip interfaces… but I am not sure if this always give you the answer you want…

Ben

3

(imported comment written by SystemAdmin)

I see what you mean since I’m comparing each adapter to only 1 active IP address. Maybe the second way is enough for now. I think that’s similar to the WINS retrieved property.

If the adapter is disabled, but has a static IP, would the second method still return it? I’ll have to try this tomorrow or Thursday.

Paul

4

(imported comment written by hbkrules6991)

I realize this is an older post but our company is looking to update the WINS on all the servers…we have many servers with multiple NICS in them and the easiest way to get this info would be thru the registry but I have having difficulty pulling it…this is what I got…and erroring out with “The operator “key” is not defined.”

if (exists key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces” of registry) and exists value “NameServerList” of key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces” & names of adapters of network of registry then value “NameServerList” of key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces” & names of adapters of network of registry as string else “N/A”

Any ideas?

5

(imported comment written by BenKus)

Close… it is tricky because you are embedding a “plural value” (the adapter names) in the expression…

The first issue is that you need a few more parenthesis:

q: if ((exists key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces” of registry) and (exists value “NameServerList” of key (“HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces” & names of adapters of network) of registry)) then (value “NameServerList” of key (“HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces” & names of adapters of network) of registry) as string else "N/A"
E: A singular expression is required.

but that leads to the problem of concatenating plurals with singulars so you need to do some “it” work:

q: if ((exists key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces” of registry) and (exists values “NameServerList” of keys ((“HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces” & it) of names of adapters of network) of registry)) then (values “NameServerList” of keys ((“HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces” & it) of names of adapters of network) of registry) as string else "N/A"
A: N/A

But this expression is equivalent may be simpler to use (it will automatically return “” if no results are found:

q: (values “NameServerList” of keys ((“HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces” & it) of names of adapters of network) of registry)

Ben

6

(imported comment written by hbkrules6991)

Ben thanks as always…unfortuneately I am getting for each server listed, which I know is not right. I also ran it in the Relevance Debugger and that also did not give any results… :frowning:

7

(imported comment written by SystemAdmin)

This is my relevance for detecting WINS servers…warning, it will not work in QnA, but it will work if you put it in a fixlet or analysis:

(primary wins server of adapters whose (cidr string of it = wake on lan subnet cidr string) of network != “10.0.0.1” or secondary wins server of adapters whose (cidr string of it = wake on lan subnet cidr string) of network != “10.0.0.2”)

And then here is action script to change the WINS servers (values are all obviously 0’d out to hide real address):

createfile until END-FILE
Windows Registry Editor Version 5.00

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\Tcpip_{name of adapters whose (cidr string of it = wake on lan subnet cidr string) of network}
“NameServerList”=hex(7):00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,
00,00,00
END-FILE

move __createfile wins.reg
waithidden regedit.exe /s wins.reg

Originally I was trying to use netsh to set the WINS servers, but I was running into strange issues with the primary and secondary addresses randomly being interchanged. I thought at first that even with using “waithidden” that the system was applying them out of order, so I put a 30 second pause inbetween, but they seen changed to get mixed up from time to time. This is the code that I ended up abandoning if anyone is interested:

waithidden netsh interface ip set wins name="{friendly name of adapters whose (cidr string of it = wake on lan subnet cidr string) of network}" static addr=10.0.0.1

parameter “startTime”="{now}"
pause while { (now-time(parameter “startTime”) < 30*second) }

waithidden netsh interface ip add wins name="{friendly name of adapters whose (cidr string of it = wake on lan subnet cidr string) of network}" addr=10.0.0.2 index=2

parameter “startTime”="{now}"
pause while { (now-time(parameter “startTime”) < 30*second) }

Hope this helps-- good luck.

8

(imported comment written by BenKus)

Looks like we didn’t add the “tcpip_” component to the registry key…

My personal computer doesn’t have any data in these registry values, but the values do exist:

q: preceding texts of lasts “%00” of (it as string) of (values “NameServerList” of keys ((“HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\Tcpip_” & it) of names of adapters of network) of registry)

Ben

9

(imported comment written by hbkrules6991)

Ben thanks!! it worked :slight_smile:

10

(imported comment written by SystemAdmin)

I am trying to do something somewhat similar and need some help. I want to check relevance on the NetBIOS over TCPIP setting on the network adapters and then disable it if enabled.

The registry key that I want to key off of and change is:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces\Tcpip_{guifofthenetworcard}

“NetbiosOptions”=dword:00000002

How do I write the relevance to iterate through all the network card keys of the registry in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces path to check on that value?

Then based off that what would the action syntax be to actually loop through all those keys (the instances of the network adapters) to change the value to that above.

When I replace the NameServerList value with NetbiosOptions and I just get “plural string” as the response on the fixlet debugger. Pointers?

11

(imported comment written by NoahSalzman)

The end result is that all “NetBiosOptions” attributes get set to the same value right? So, rather than check the value, is it OK to just blindly change the value regardless of what the current state is?

+Edit: +this is the relevance you would use to check for the condition where one of your NetBiosOptions is not currently set at 2

exists ((values “netbiosoptions” of keys of keys “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\NetBT\Parameters\Interfaces” of registry) whose (it as integer != 2))

12

(imported comment written by SystemAdmin)

That relevance works great for the relevance. Thanks! How would I go about making the change in the action script to make that value change iterate through all the sub-keys?

13

(imported comment written by jgstew)

Here are two options I came up with for surfacing all configured WINS servers: