SMB Domain Information via NMAP

[paul]

I am starting to play around with SMB information more for profiling.  When I scan my domain joined machines I am not getting the domain information:

SMB.cpe cpe:/o:microsoft:windows_10::-

SMB.lanmanager Windows 10 Enterprise 6.3

SMB.operating-system Windows 10 Enterprise 15063

SMB.server IUSCCCATO1\x00

I have seen workgroup information show up for non-domain joined devices and domain joined information show up for devices not in the domain ISE is a part of.  If I do a scan using Zenmap I get the domain information of from the device just fine. I am scanning from a non-domain joined device with Zenmap so I know there are no special permissions required.

Any thoughts would be appreciated.

[paul]

As an example here is what Zenmap gets from scanning a system with the SMB script:

|   OS: Windows 7 Professional 7601 Service Pack 1 (Windows 7 Professional 6.1)

|   OS CPE: cpe:/o:microsoft:windows_7::sp1:professional

|   Computer name: UHAOC--PHOTOID

|   NetBIOS computer name: UHAOC--PHOTOID\x00

|   Domain name: chp.clarian.org

|   Forest name: clarian.org

|   FQDN: UHAOC--PHOTOID.chp.clarian.org

There should be no reason ISE isn't getting that data.  The SMB domain field is already a NMAP variable defined in ISE.

[hslai]

When I allowing TCP 139 and 445 only from ISE to a domain Windows computer, I got the info on the specific ports only. When I disable the Windows Firewall on the domain Windows computer, I got the host script results with the OS and Domain info; e.g.

SMB.cpe	cpe:/o:microsoft:windows_10::-
SMB.fqdn	wx-corp.demo.local
SMB.lanmanager	Windows 10 Enterprise 2016 LTSB 6.3
SMB.operating-system	Windows 10 Enterprise 2016 LTSB 14393
SMB.server	WX-CORP\x00
SMB.workgroup	DEMO\x00

[paul]

Why is ISE not pulling SMB domain. Use Zenmap SMB OS script it is all available.

Sent from my iPhone

[hslai]

I believe the system where you ran Zenmap SMB OS script has more access than ISE. Please ensure these ports are allowed from ISE to the endpoints:

T:445,139,U:137

[hslai]

Regarding no SMB domain or forest, it's a known issue -- CSCuy27476, which might take a couple of days to be visible to you.