Information on Browser Operation

This article was previously published under Q102878
This article has been archived. It is offered "as is" and will no longer be updated.
The Computer Browser service lets you track servers that are active onthe network with a minimum of network overhead. It consists of twocomponents on a Windows NT or Windows NT Advanced Server computer.

The User Mode component is the Browser, which is part of the LANManager Server service. This portion is responsible for maintainingthe browse list, remoting the NetServerEnum API, and managing thecomputer's role as a Browser (or non-Browser).

The Kernel Mode component is the Datagram Receiver and is in charge ofreceiving and managing datagrams.

Browser Roles

A network can contain the following types of servers related tobrowsing:

Non-Browser Servers - Do not maintain browse lists, but announcethemselves periodically to the Master Browser.

Potential Browser - Can become a Browser server if needed.

Backup Browser - Maintains a browse list of servers and domains thatit retrieves from the Master Browser.

Master Browser - Receives server and Domain announcements, sendsbrowse lists to Backup Browsers, responds to clients requesting browseserver lists, promotes Potential Browsers to Backup when needed, andannounces the domain to inform the Master Browsers of other domains ofthe domain name and Master Browser for that domain.

Preferred Master Browser - Same as Backup Browser, except that browser elections are biased when the IsDomainMasterBrowser (Windows NT 3.51 or earlier) registry value or the IsDomainMaster (Windows NT 4.0 or Windows 2000) registry value is set to TRUE.

Domain Master Browser - The primary domain controller of a domain isgiven a special bias in browser elections so that it will become theDomain Master Browser. This allows browsing to be effective when adomain spans multiple subnets. A directed datagram is used by MasterBrowsers on each subnet to announce itself to the Domain MasterBrowser. This is made possible through an entry in the LMHOSTS file onthe Master Browsers for the Domain Controller. This makes it necessaryto have a Windows NT Advanced Server, NT Workstation, Windows NT Server or Windows 2000 Pro computer to browse across wide area network (WAN) connections.

There will be at least one Master Browser on a workgroup/domain andone Backup Browser for every 32 systems in that workgroup/domain. Thismeans that in a domain/workgroup with fewer than 32 systems, therewill be one Master and one Backup Browser. One more Backup Browserwill be added for every 32 systems. This is accomplished by the MasterBrowser telling a Potential Browser to become a Backup Browser.

Browser NetBIOS Names

Several special NetBIOS names and Mailslots are used to maintain andretrieve browse lists. Names listed here as "DOMAIN(xx)" indicate thedomain name followed by the hex value (xx) and padded with spaces tothe 16th byte.


This name is registered by the Master Browser and is used to broadcastand receive domain announcements on the local subnet. It is throughthis name that Master Browsers for different domains learn the namesof different domains and the names of the Master Browsers on thosedomains.


This is the name to which server announcements are broadcast inMicrosoft LAN Manager so that other Microsoft LAN Manager computerscan track the servers on the network. Windows NT computers do not makethese broadcasts unless the LMAnnounce option has been enabled byconfiguring the Server service with the Control Panel/Networksapplication. This means that LAN Manager systems will not see thesecomputers unless this option is enabled.

A LAN Manager server within the Windows NT domain will be seen by theBrowser and therefore other systems on the network. A LAN Managerdomain that doesn't contain any Windows NT computers will not appearon the browse lists unless it is specified as an Other Domain throughthe Control Panel/Networks application in the Computer Browserconfiguration.


This name is registered by Master Browsers. It is used by clients tofind a Master Browser server. A client will broadcast to this name toget a list of browser servers from the Master Browser. The MasterBrowser will send a list of browser servers to the client from whichthe client will cache three of these server names. The client willthen randomly pick one of these servers to request a list of serversand domains from.


This name is registered by the primary domain controller in a domainonly and allows unique identification of that computer.


This name is registered by all Browser servers and Potential Browserservers in a domain or workgroup. It is used for announcement requestswhich are sent by Master Browsers to fill up its browse lists, and forelection request packets to force an election. Elections are performedby sending a packet out to this name that contains your electioncriteria.

The election criteria for a Browser is based on the Browser's currentrole in the domain and its current state, using the followinghierarchy:

   Operating System Type:        0xFF000000   Windows for Workgroups:       0x00000000   Windows NT:                   0x01000000   Windows NT Advanced Server:   0x02000000   Election Version:             0x00FFFF00   Per version criteria:         0x000000FF   PDC:                          0x00000080   Preferred Master:             0x00000008   Running Master:               0x00000004   MaintainServerList = Yes:     0x00000002   Running Backup Browser:       0x00000001				

The Browser will OR all of the appropriate election criteria and usethis to determine the system's election criteria.

The criteria for determining if a Browser has won an election is thefollowing:
  • If your election version is greater than the sender's election version, you win.
  • Else if your election criteria is greater than the sender's criteria, you win.
  • Else if you have been up longer than the sender, you win.
  • If the above comparisons fail to determine a Master Browser, the computer with the lexically lowest name will win the election.
If a Browser receives an election request, it compares the criteria toits own and if it wins it will send out up to four election packets.If after this time it does not receive an election packet with abetter criteria, it will become the Master Browser. Elections can becaused by any computer that cannot locate a Master Browser, or by aPotential Browser during initialization. An election is alsoinstigated by a Master Browser when it shuts down gracefully.

Mail Slots

Server and Domain Names in the browse list are aged and are removedfrom the browse list if they have not been heard from in threeAnnounce periods.

The Browser uses Mailslot Transactions to pass these messages betweensystems. Two Mailslots are used.

For messages intended for all systems including LAN Manager andWindows for Workgroups, MAILSLOT\LANMAN is used.

MAILSLOT\BROWSE is used for messages intended for Windows NT andWindows NT Advanced Server systems.
wfw wfwg prodnt browsemaster

Article ID: 102878 - Last Review: 12/04/2015 09:37:34 - Revision: 2.1

Microsoft Windows 2000 Server, Microsoft Windows 2000 Professional Edition, Microsoft Windows NT Advanced Server 3.1, Microsoft Windows NT Server 3.5, Microsoft Windows NT Server 3.51, Microsoft Windows NT Server 4.0 Standard Edition, Microsoft Windows NT Workstation 3.1, Microsoft Windows NT Workstation 3.5, Microsoft Windows NT Workstation 3.51, Microsoft Windows NT Workstation 4.0 Developer Edition, Microsoft Windows NT Advanced Server 3.1

  • kbnosurvey kbarchive kbnetwork KB102878