Windows 10: [WIN10] Windows 10 phantom lan connections with file sharing

Background:

* Fresh windows 10 (1803) install using ISO direct from microsoft.
* LAN configured on 10.x.x.x/24 subnet

After accessing file share on a different pc (same subnet), windows will attempt to open up phantom port 445 (dest) connections to remote ip's 192.168.1.241 and 192.168.3.241. There is nothing on the network configured for the 192.168.x.x subnets.

Service connecting is SYSTEM, PID 4 (see pic above). My firewall (UTM) is set to block anything in or out that isn't explicitly permitted. I discovered this issue when I noticed number of packet filter entries was unusually high.

There's two ways of dealing with this. I can configure the firewall to just drop and not log these packets or do the same in the windows firewall on the offending pc. The first I believe still generates this noise on the network, the second blocks it such that it never leaves the pc.

I consider both of these work arounds as bandaids. I'd really like to figure out why the windows box is even attempting to create these connections. Nothing in netstat or tcpview gives me any more detail other than what's pictured above. I tried disabling various discovery options but this still persists. As mentioned earlier it is related to file sharing. These outbound attempts do not show up if the windows 10 box doesn't attempt to access any network shares.

Both router2 and local.domain are on the 10.x.x.x/24 subnet.

https://i.imgur.com/z0dg103.png

:)

 

Phantom router on network


Recently I've noticed a "phantom" router appearing in my network. The Belkin router is not mine, the Linksys is.

Properties of the Belkin router list serial number, MAC address, model number, model, manufacturer, but no IP address. It only shows up on my desktop, not the Pro 3's or HP laptop's File Explorer under Network.

Desktop is connected to network with a Netgear WNDA3100v3 N600 Dual Band USB Adapter - WPA2-PSK security type. Pro 3 and Laptop connect to network with their internal wireless connections

Haven't noticed any "strange" behavior, or usage, on my machines, but am curious as to why it is appearing in my network.

Also, any suggestions for a program that will scan the network and list all units "attached" to it?

 

Windows 10 Tweaks

Pressing “Windows+Pause Break” (it’s up there next to scroll lock) opens the “System” Window.

Windows 10: In the new version of Windows, Explorer has a section called Quick Access. This includes your frequent folders and recent files. Explorer defaults to opening this page when you open a new window. If you’d rather open the usual This PC, with links to your drives and library folders, follow these steps:

• Open a new Explorer window.
• Click View in the ribbon.
• Click Options.
• Under General, next to “Open File Explorer to:” choose “This PC.”
• Click OK

credit to Lifehacker.

 

W10 Sharing on LAN -- Need to REFRESH Network to access shares

I still think this must be a setting and so re-installing Win10 won't fix. Before you reinstall, I suggest that you create a new Workgroup and see if that works. (Choose Work in the Wizard, not home)

Good luck...

Regards