How do I hide one network places workgroup?

[ZT3000]

[Pertains to Microsoft Operating System]

From a Windows 2000 Server when a user clicks on Network places, Entire Network, Entire contents, they see 3 workgroups in my office but what I need is to hide just one of 3 existing networks so it doesn't show up in the list.
There is a way to hide ALL the workgroups but I don't need that.

Any ideas??

Thanks.

[sec_ware]

Hi

I have not tested what I propose, but I could think of two ways to achieve this:

browser service

The machine elected as master browser sends browser service broadcast all 12 minutes.
According to the replies, he maintains a list of the domain/workgroup names and computers
therein. An entry is deleted after 3 unsuccessfull attempts for verification (ie it may take 36
minutes to have the workgroup vanished).

This knowledge brings me to the following two ideas:

the overkill method

Disable the Computer Browser Service on all machines in the workgroup you would
like to hide. Hence, these machines are not responding to the broadcasts, but you
cannot use the network neighbourhood anymore.

the registry method

There is a way to hide one machine by not announcing itself/responding to
browser service broadcasts.

Create in [1]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

a value

Hidden

and set the REG_DWORD to 1.

This corresponds to the command

net config server /hidden:yes

I assume, that if no computer in a workgroup is responding, the workgroup does
not exist for the computer browser service, and therefore, is not shown.

Cheers.

[1] http://www.petri.co.il/hide_a_server...er_service.htm

/edit: there is some problem with the url.
Domain: www.petri.co.il
Page: hide_a_server_from_the_microsoft_computer_browser_service.htm

[ZT3000]

Thanks for the reply!

The overkill method will shutdown at least one workgroups ability to access it's server, so that might not work. (Each subnet has an application/file server).

The registry method might work, but needs testing. Makes it hard to allow new shares to be seen/used after the fact, not sure about existing shares either.

Here's another solution:

Setup a scope ID. Something I used to do in Win95?/98, but have long forgotten.
This would allow normal share/interaction within the workgroup but invisibility outside the scope (other networks). (The things I forget as I get older...sigh...)

Another security by obscurity method.

[sec_ware]

Hi

Two questions:

one workgroups ability to access it's server, so that might not work

The overkill method is not the method I would choose, but I do not understand
why this should happen. The workstation and server services are still running.
By an explicit configuration, you should still be able to access all ressources.
The computer browser service just maintains an updated list of computers on the
network and supplies this list to computers designated as browsers. If this service
is stopped, this list will not be updated or maintained[1]

Setup a scope ID.

This is a solution, but then that workgroup will be completely isolated from the other
machines (outgoing and incoming), I think. It this what you would like to achieve?
I thought you simply want to have vanished the machines from the network
neighbourhood.

Cheers.

[1] http://www.theeldergeek.com/computer_browser.htm