Skip to content

AFD, IRP stack and NetBIOS in Windows 11 25H2

On this page

Short answer

Section titled “Short answer”

DisableRawSecurity, IrpStackSize and NetbiosOptions are confirmed at the level of reading and scope. Changing the first two only makes sense when diagnosing a specific AFD problem; disabling NetBIOS is justified only where there are no dependent legacy devices.

What was checked

Section titled “What was checked”

We checked which components read the AFD and NetBT parameters, how the values are normalized, and which processing path they affect.

Scope of research

Section titled “Scope of research”

Windows 11 25H2 build 26200.9168, afd.sys and NetBT drivers. Corporate WINS networks and third-party AFD filters were not tested.

Methodology

Section titled “Methodology”

Driver analysis, observation of parameter reads in a system trace, and cross-checking against public Microsoft documentation.

Canonical values

Section titled “Canonical values”
Registry path Value Type Default Role
HKLM\SYSTEM\CurrentControlSet\Services\Afd\Parameters DisableRawSecurity REG_DWORD 0 admin check for raw sockets
same path IrpStackSize REG_DWORD 4, range 2..64 depth of the AFD IRP stack
HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces\* NetbiosOptions REG_DWORD 0 NetBIOS over TCP/IP for the interface

AFD and IRP

Section titled “AFD and IRP”

afd.sys participates in Winsock socket operation. DisableRawSecurity=0 preserves the administrator privilege check for raw-like sockets. Any non-zero value disables this check without shortening the normal TCP/UDP data processing path.

IrpStackSize sets the number of stack locations in AFD I/O requests. By default the driver uses 4; values below 2 are replaced with 2, values above 64 are capped at 64. Too small a value can interfere with a long filter chain, while too large a value increases the size of internal IRP contexts.

These parameters should be changed only for a specific AFD compatibility problem with filter drivers or a confirmed shortage of IRP stack locations. Without such diagnostics there is no basis for changing them.

Results

Section titled “Results”

Parameter reads are confirmed during driver initialization. IrpStackSize is normalized to the range 2..64. NetbiosOptions=2 stops NetBIOS over TCP/IP on the selected interface and does not affect LLMNR and mDNS; if the value is absent, the system returns 0.

NetbiosOptions

Section titled “NetbiosOptions”

NetbiosOptions is set separately for each interface: 0 uses the DHCP setting, 1 forcibly enables NetBIOS over TCP/IP, 2 disables it. If the value is absent or has the wrong type, the system restores 0 and again uses the DHCP setting.

The value 2 stops NetBIOS over TCP/IP on the selected interface, reducing the broadcast queries and name resolution associated with it. At the same time, legacy NAS, printers and computers that are not reachable via DNS may stop being discovered. The setting does not affect the separate LLMNR and mDNS mechanisms.

What is confirmed

Section titled “What is confirmed”
  • The paths, types, default values and ranges of the parameters in the build studied.
  • Parameter reads during driver initialization.
  • DisableRawSecurity: a non-zero value removes the privilege check for raw-like sockets without shortening the normal TCP/UDP path.
  • NetbiosOptions is set for each interface; if the value is absent, the system restores 0.

What is not confirmed

Section titled “What is not confirmed”
  • The effect of the change on network speed, ping or FPS.
  • Behavior in WINS networks and with third-party AFD filters.
  • The benefit of changing IrpStackSize outside a confirmed shortage of stack locations.

Practical conclusion

Section titled “Practical conclusion”

Do not change DisableRawSecurity and IrpStackSize without a specific compatibility problem. Disable NetBIOS only when there are no legacy NAS, printers and computers that depend on NetBIOS name resolution.

Restoring the state

Section titled “Restoring the state”

Return 0 for DisableRawSecurity, the default 4 for IrpStackSize, and 0 or 1 for NetbiosOptions, then restart Windows.

Limitations and sources

Section titled “Limitations and sources”

The conclusions apply to Windows 11 25H2 and the corresponding drivers. Corporate WINS networks and third-party AFD filters were not tested.

For how to reproduce the dynamic part of the observations, see How to check it yourself.

The research and the tools used belong to the BoosterX developer, so the developer has a direct interest in the results. The methodology and the limits of applicability are described above, and the conclusions can be verified against open data and the public sources listed.

Public sources checked: 2026-09-02.

Change history

Section titled “Change history”
  • 2026-09-20: added a conflict-of-interest disclaimer and a link to independent verification of the dynamic observations in the methodology.
  • 2026-09-02: first publication; readers, ranges and the limits of the effect on network operation confirmed.