LMHOSTS #Include Directives Requires Null Session Support

In order for #INCLUDE directives in an LMHOSTS file to succeed at startup time, the referenced system(s) shares must support "null sessions". Null sessions are those where the user credentials passed in the Session Setup SMB are null.

The LMHOSTS files used by Microsoft Windows NT version 3.1 and 3.5 and Microsoft TCP/IP-32 allow the contents of LMHOSTS files on other systems to be referenced using the #INCLUDE keyword. Parsing of the LMHOSTS file is done at startup time, prior to a user logging on. Therefore the system must use a null username to obtain the contents of remote LMHOSTS files that are included, and those files must be publicly available.

Windows NT version 3.1 supports null sessions by default. However, Windows NT version 3.5 does not provide this support unless specifically configured to do so. This change was made in order to provide a higher default level of security.

If null session support is desired, it may be configured on a per-share basis on the computer(s) containing the LMHOSTS files to be included, as follows:

WARNING: Using the Registry Editor incorrectly can cause serious, system- wide problems that may require you to reinstall Windows NT to correct them. Microsoft cannot guarantee that any problems resulting from the use of the Registry Editor can be solved. Use this tool at your own risk.

1. Open the Registry Editor, REGEDT32.EXE
2. From the HKEY_LOCAL_MACHINE subtree, go to the key:
   
   

         \System
           \CurrentControlSet
             \Services
               \LanmanServer
                 \Parameters
                   \NullSessionShares

   
   NOTE: NullSessionShares is type REG_MULTI_SZ.
3. Create a new line within the NullSessionShares key, type in the share you want to access with a null session(for example: "PUBLIC")
4. Stop and restart the server.

An alternative is to have the user log on to the system, and then type "nbtstat -R" which re-parses the LMHOSTS file. At this point, since the #INCLUDE is done in the context of the current user, any LMHOSTS file that is available to the currently logged on user on the network can be retrieved.

NOTE: #INCLUDE and other LMHOSTS directives are case-sensitive.