Learn how this important service operates
The Microsoft Computer Browser service maintains lists of your network's Windows-based domains, workgroups, and computers, as well as other network equipment that supports the NetBIOS protocol (e.g., Network Attached StorageNASunits). These browse lists are the source of the information that users see when they expand Network Neighborhood in Windows Explorer. (In Windows 2000based networks, the Computer Browser service exists only to support earlier Windows versions. In native-mode Win2K Active DirectoryADnetworks with AD-enabled clients, AD replaces the Computer Browser service. However, mixed-mode networks, which maintain pre-Win2K domain controllersDCsand networks with clients that aren't AD-enabled still use the Computer Browser service.)
When your network contains multiple Win2K and Windows NT domains, broadcast domains, or protocols, the browsing system (i.e., the process of maintaining and distributing browse lists, as well as the computers involved in that process) can quickly become complex. Troubleshooting the Computer Browser service to ensure that the list contains all the computers you want it to containand excludes those you want to hide from the general population of network usersexercises your full range of networking skills. Before you undertake such a task, you need to have a strong grasp of how the service works: what roles various systems can take, how those roles are determined, how systems interact within the context of the service, and what sorts of problems might cause the browse list to be incomplete.
Browser Roles
Any computer that can collect, maintain, and distribute a browse list is considered a browser and takes on one or more of five browser roles: master browser, domain master browser, backup browser, potential browser, and nonbrowser. Computers running Windows for Workgroups (WFW) 3.11 or any more recent Windows version (i.e., Windows XP, Win2K, NT, Windows Me, or Windows 9x) can act as a browser.
At start-up, Windows computers announce themselves through a broadcast to the local network segment (i.e., the broadcast domain for each network protocol the computer uses). On each segment, one computer takes the role of master browser and assumes responsibility for receiving these broadcast announcements. Each master browser maintains browse lists for its segment andon IP-based networks onlyforwards these lists to the domain master browser.
The PDC (or the PDC emulator in a Win2K AD network) always takes the role of domain master browser. The domain master browser acts as a central repository, compiling the browse lists it receives from the network's master browsers, then sending a complete browse list to each master browser. The domain master browser also takes on the role of master browser for its network segment. The domain master browser role is active only on networks that use TCP/IP. (For an explanation of how the Computer Browser service deals with various protocols on a network, see the sidebar "Broadcast Domains, Network Protocols, and Adapters.")
Backup browsers on each network segment receive a copy of the complete browse list from the segment's master browser, then supply that list in response to client requests. The master browser also acts as a backup browser and can include its name in the list of backup browsers that it sends to clients.
A potential browser can act as a master or backup browser, but might not currently be acting in either role. A nonbrowser is a computer that an administrator disabled from maintaining a browse list. When you attempt to start the Computer Browser service on a nonbrowser, the service fails to start with error code 2550 and the system logs event ID 7024. (Clients that don't run the Computer Browser service can still obtain a browse list and display it in Windows Explorer.)
As a Win2K or NT systems administrator, you can edit registry entries to influence the role each computer will play in network browsing. Table 1 summarizes these registry entries and their purposes. Most browser-related entries are found in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters subkey.
When computers on a network segment belong to different domains or workgroups, at least one computer from each of the represented domains or workgroups maintains a browse list for that domain or workgroup. Master browsers for each domain and workgroup in the segment announce themselves to one another so that users can see resources in all the domains and workgroups, even those that exist outside the segment.
Which System Gets the Job?
When a potential browser that's a PDC, that you've configured as a preferred master browser, or that can't find a master browser for one of its network protocols comes online, it calls an election among the potential browsers in the segment. The election is rigged to tilt the outcome toward the Win2K or NT server with the most recent version of the browser-election protocol (i.e., the rules that different versions of Windows use to decide which computer will be master browser). For systems using the same browser-election protocol version, server versions of Win2K or NT always beat out XP, Win2K Professional, and NT Workstation versions, which always beat out Win9x and WFW versions. Within each set of versions (i.e., server, Win32 workstation, or Win9x and WFW), the pecking order from highest to lowest is PDC, WINS system, preferred master browser, running master browser, system configured to be a master browser or backup browser, and running backup browser. As a final tiebreaker, the computer whose name comes first alphabetically (regardless of case) wins; for example, a computer named ART would beat a computer named BOB.
If you restrict Anonymous access by clicking Administrative Tools, Local Security Policy, Local Policies, Security Options and setting Additional restrictions for anonymous connections to No access without explicit anonymous permissions, the transfer of the lists fails.<P>
Some Microsoft security articles recommend restricting Anonymous access, although others say that you shouldn't do this in mixed-mode environments. We chased this problem for a while before we realized why machines on some network segments weren't showing up in the domain master browser's list.
You present some good information. The effect of nonstandard security settings on the browser service is a topic I hadn't thought to include.<BR>
—John Green
Bruce E. Larson January 15, 2004