diff --git a/samba/CHANGELOG.md b/samba/CHANGELOG.md
index dadaaf19d..0cf6c091d 100644
--- a/samba/CHANGELOG.md
+++ b/samba/CHANGELOG.md
@@ -1,5 +1,8 @@
 # Changelog
 
+## 12.8.0
+- Add configuration option to disable NetBIOS. When disabled, the nmbd service is not started and only port 445 is allowed (port 139 is blocked.)
+
 ## 12.7.1
 
 - Enabled kernel oplocks in smb.conf to ensure changes made to files on disk are available immediately via SMBD. This covers all shares except backup, and media as the contents shouldn't be changed by the server once they're written in those shares.
diff --git a/samba/DOCS.md b/samba/DOCS.md
index 90c95ab85..7947d44e2 100644
--- a/samba/DOCS.md
+++ b/samba/DOCS.md
@@ -35,10 +35,9 @@ Directory | Description
 App configuration:
 
 ```yaml
-workgroup: WORKGROUP
-local_master: true
 username: homeassistant
 password: YOUR_PASSWORD
+workgroup: WORKGROUP
 enabled_shares:
   - addons
   - addon_configs
@@ -47,6 +46,17 @@ enabled_shares:
   - media
   - share
   - ssl
+compatibility_mode: false
+apple_compatibility_mode: true
+netbios: true
+local_master: true
+server_signing: "default"
+veto_files:
+  - ._*
+  - .DS_Store
+  - Thumbs.db
+  - icon?
+  - .Trashes
 allow_hosts:
   - 10.0.0.0/8
   - 172.16.0.0/12
@@ -54,21 +64,8 @@ allow_hosts:
   - 169.254.0.0/16
   - fe80::/10
   - fc00::/7
-veto_files:
-  - "._*"
-  - ".DS_Store"
-  - Thumbs.db
-compatibility_mode: false
 ```
 
-### Option: `workgroup` (required)
-
-Change WORKGROUP to reflect your network needs.
-
-### Option: `local_master` (required)
-
-Enable to try and become a local master browser on a subnet.
-
 ### Option: `username` (required)
 
 The username you would like to use to authenticate with the Samba server.
@@ -77,6 +74,10 @@ The username you would like to use to authenticate with the Samba server.
 
 The password that goes with the username configured for authentication.
 
+### Option: `workgroup` (required)
+
+Change WORKGROUP to reflect your network needs.
+
 ### Option: `enabled_shares` (required)
 
 List of Samba shares that will be accessible. Any shares removed or commented out of the list will not be accessible.
@@ -107,6 +108,19 @@ This can cause issues with file systems that do not support xattr such as exFAT.
 
 Defaults to `true`.
 
+### Option: `netbios`
+
+NetBIOS is a legacy network protocol for accessing SMB/CIFS shares. Enable for legacy clients older than Windows Vista (Windows 95/98/ME, Windows NT,
+Windows 2000, Windows XP and LanManager), or OS X 10.9 (Mavericks). This setting is enabled by default for compatibility; disable it on modern installations.
+
+Defaults to `true`.
+
+### Option: `local_master`
+
+When NetBIOS is enabled, try and become a local master browser on a subnet.
+
+Defaults to `true`.
+
 ### Option: `server_signing`
 
 Configure the SMB server signing requirement. This option can improve security by requiring message signing, which helps prevent man-in-the-middle attacks.
diff --git a/samba/Dockerfile b/samba/Dockerfile
index 63b54d91d..c7cd5390d 100644
--- a/samba/Dockerfile
+++ b/samba/Dockerfile
@@ -19,3 +19,6 @@ COPY rootfs /
 
 HEALTHCHECK --start-period=3s \
     CMD smbclient -L '\\localhost' -U '%' -m SMB3
+
+ENV \
+    S6_STAGE2_HOOK=/etc/s6-overlay/scripts/enable-check.sh
diff --git a/samba/config.yaml b/samba/config.yaml
index 00bdbc2aa..e716065da 100644
--- a/samba/config.yaml
+++ b/samba/config.yaml
@@ -1,5 +1,5 @@
 ---
-version: 12.7.1
+version: 12.8.0
 slug: samba
 name: Samba share
 description: Expose Home Assistant folders with SMB/CIFS
@@ -23,7 +23,6 @@ options:
   username: homeassistant
   password: null
   workgroup: WORKGROUP
-  local_master: true
   enabled_shares:
     - addons
     - addon_configs
@@ -34,6 +33,8 @@ options:
     - ssl
   compatibility_mode: false
   apple_compatibility_mode: true
+  netbios: true
+  local_master: true
   server_signing: "default"
   veto_files:
     - ._*
@@ -52,11 +53,12 @@ schema:
   username: str
   password: password
   workgroup: str
-  local_master: bool
   enabled_shares:
     - "match(^(?i:(addons|addon_configs|backup|config|media|share|ssl))$)"
   compatibility_mode: bool
   apple_compatibility_mode: bool
+  netbios: bool
+  local_master: bool
   server_signing: list(default|auto|mandatory|disabled)
   veto_files:
     - str
diff --git a/samba/rootfs/etc/s6-overlay/scripts/enable-check.sh b/samba/rootfs/etc/s6-overlay/scripts/enable-check.sh
new file mode 100755
index 000000000..4643c916e
--- /dev/null
+++ b/samba/rootfs/etc/s6-overlay/scripts/enable-check.sh
@@ -0,0 +1,12 @@
+#!/command/with-contenv bashio
+# shellcheck shell=bash
+# ==============================================================================
+# Enable/disable nmbd service per config
+# ==============================================================================
+if bashio::config.true 'netbios'; then
+    touch /etc/s6-overlay/s6-rc.d/user/contents.d/nmbd
+    bashio::log.info "Service nmbd enabled"
+else
+    rm -f /etc/s6-overlay/s6-rc.d/user/contents.d/nmbd
+    bashio::log.info "Service nmbd disabled"
+fi
diff --git a/samba/rootfs/usr/share/tempio/smb.gtpl b/samba/rootfs/usr/share/tempio/smb.gtpl
index 2a321b5a7..df72fcca1 100644
--- a/samba/rootfs/usr/share/tempio/smb.gtpl
+++ b/samba/rootfs/usr/share/tempio/smb.gtpl
@@ -32,6 +32,10 @@
    vfs objects = catia fruit streams_xattr
    {{ end }}
 
+   {{ if not .netbios }}
+   smb ports = 445
+   {{ end }}
+
    server signing = {{ .server_signing }}
 
    kernel oplocks = yes
diff --git a/samba/translations/en.yaml b/samba/translations/en.yaml
index 7fee4e38d..43ba9a80d 100644
--- a/samba/translations/en.yaml
+++ b/samba/translations/en.yaml
@@ -11,9 +11,6 @@ configuration:
   workgroup:
     name: Workgroup
     description: Change WORKGROUP to reflect your network needs.
-  local_master:
-    name: Local master
-    description: Enable to try and become a local master browser on a subnet.
   enabled_shares:
     name: >-
       Enabled Shares - allowed values are:
@@ -33,6 +30,17 @@ configuration:
       Enable Samba configurations to improve interoperability with Apple
       devices. May cause issues with file systems that do not support xattr
       such as exFAT.
+  netbios:
+    name: Enable NetBIOS over IP
+    description: >-
+      Enable NetBIOS over IP for legacy SMB clients (Windows 95/98/ME, Windows
+      NT, Windows 2000, Windows XP and LanManager clients). Disable to improve
+      security and performance if you do not have legacy SMB clients.
+  local_master:
+    name: Local master
+    description: >-
+      When NetBIOS is enabled, try and become a local master browser on a
+      subnet.
   server_signing:
     name: Server signing
     description: >-