Safety of MS Sharing on LAN over TCP/IP via NetBIOS and/or Direct SMB

Question

Shalini Sampath Kumar at http://answers.microsoft.com/en-us/windows/forum/windows_7-security/ suggested I post this question over
here:
What is the safest recommended way to set up MS File and Printer Sharing on a LAN with both Windows 7 Pro and XP Pro machines?  Does "Direct hosting of SMB over TCP/IP," help?  What about setting a "Scope ID" (or did that go out
with Windows NT)?
Background:  I've been trained to be paranoid about NetBIOS over TCP/IP.  Right now I have only XP Pro machines on my peer-to-peer workgroup LAN (behind a NAT router and with Simple File Sharing turned off), on which File and Printer Sharing has been
unbound from TCP/IP and bound to NetBEUI instead, so I feel fairly safe.  Port scanning by ShieldsUp doesn't see any ports through the router, open or closed -- in other words, it appears to be "stealthed," for what that's worth.  With
NetBIOS disabled on all computers inside the LAN, however, can I perform a valid test of what will happen when File and Printer Sharing is re-bound to TCP/IP?
My New Problem:  I'm planning to add Window 7 Pro machines, for which NetBEUI isn't an option, and then to transition entirely to Win7 before XP goes off extended support in April.  I will still use a peer-to-peer architecture with password-protected
sharing turned on (no HomeGroup).  It appears that I can still get rid of NetBIOS (and WINS) in favor of "Direct hosting of SMB over TCP/IP," which sounds safer.  Apparently then only port 445 will be vulnerable instead of ports 137-139. 
In any case I want to do everything I can to protect my file-sharing port(s) from the Internet (e.g., from anyone who might break into my LAN either by making a wireless connection or by hacking the router itself).  Can anybody give a clear set of steps
to change sharing from NetBIOS (which I would like to disable entirely) to direct hosting of SMB and to verify that I'm protected as well as possible?
I will have to completely revamp the network-file-sharing configuration of my XP machines as soon as the first Win7 machine goes on line (and possibly tweak the configuration of Win7 as well), perhaps as early as this week. I want to do this in the way that
maximizes security to the extent possible.  Thanks in advance more details and guidance on this topic! -- JCW2
P.S. -- These computers are all laptops and will be used away from my home LAN -- another reason for paranoia about File and Printer Sharing.  I realize that Windows 7 provides an easy way to disable F&PS by selecting any new network location as
"public," but XP does not (as far as I know).  Fixing that will take more effort and be harder to remember... -- JCW2

Answer 1

Removing the NetBIOS transport has several advantages compared to NetBIOS over TCP, you can find detailed infromation in the following KB
Direct hosting of SMB over TCP/IP
http://support.microsoft.com/kb/204279/en-us
Yolanda
TechNet Community Support
Hi again -- I think I'm slowly catching up with you.  Following from my previous message...
Somebody on another forum mentioned creating "Hosts" files on each computer to substitute for the DNS server that I don't have on my workgroup.  This is intriguing if I can figure out how to set it up.  (I've heard it said that taking control of
your "Hosts" file is a good safety precaution anyhow, since it is a frequent target of hackers trying to divert legitimate Web requests to their own malicious sites.)  Does anybody have tips and/or references that would help me accomplish the name resolution
there?
Finally, what functionality do I really lose by going the Direct-Hosting-of-SMB-with-Hosts-file (or drive mapping) route as opposed to using NetBIOS over TCP/IP?  Granted, any new machine added to the network would also have to be added to all the "Hosts"
files (or mapped to a new drive letter) on each machine; but given that I already have to add it to the MAC filter and assign it a DHCP reservation in my router, this isn't a heavy burden for something that doesn't happen often.  Would everything then
work the same as if NetBIOS were providing the name resolution?
One missing piece that I see so far -- it's not obvious how this same trick would apply to printer sharing (although I'm not using that feature right now anyhow).  Could this be handled seamlessly through the "Hosts" file as well?
Thanks and Best Regards to All -- JCW2