AutomoxAutomox
Find & Share Worklets

Worklet: Disabling SMBv1 across Windows Devices

AdamW-Automox
July 14, 2020 at 5:19 pm UTC

Server Message Block (SMB) is a network communication protocol used share access to files, printers, etc across devices in a network.

SMBv1 was first designed and used 30 years ago and in no longer adequate in providing security in today’s modern network infrastructure, where the complexity is only rivaled by that of the malicious code looking to exploit it.

Frankly, using, or having SMB1 enabled is unacceptable in today’s world as you lose key protections offered by later SMB protocol versions

  • Pre-authentication Integrity
  • Secure Dialect Negotiation
  • Encryption
  • Insecure guest auth blocking, Protects against MiTM attacks.
  • Better message signing

Additionally, if your clients use SMB1, then a man-in-the-middle can tell your client to ignore all the above . All they need to do is block SMB2+ on themselves and answer to your server’s name or IP

Automox recommends that you disable SMB1 across all of your Windows devices. Below is the Worklet code needed to evaluate against if SMB1 is enabled, or disabled. If evaluation finds SMB1 enabled, is will exist with a “1”, and remediate. The remediation code, as you could guess, will disable SMB1 on the devices.

You can use the same code for Windows 10 and 8.1. I have also provided the Worklet for Windows 7.

Windows 10 and 8.1 Worklet

Evaluation:

powershell8 lines
$smb1 = Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol | ForEach-Object State

if ($smb1 -eq "Disabled")
    {exit 0
    }
else
    {exit 1
    }

Remediation:

1 line
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart

Windows 7 Worklet

Evaluation:

6 lines
$smb1 = (Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters').SMB1

if ($smb1 = 1)
    {exit 1}
else
    {exit 0}

Remediation:

1 line
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB1 -Type DWORD -Value 0 –Force

NOTE: You may need to reboot the device for it to fully take affect. Currently the Worklet will not reboot the device. You can perform the reboot on the devices once you apply the Worklet. You can use the Worklet: Predictable Reboot Notifications for Windows to send reboot notification to the end-user, and reboot the device.

-Adam

This discussion is archived and closed to replies. Continue it in the Automox Community Slack.

Discuss on Slack
Back to all discussions