How to disable SMBv1 | PDQ (2024)

This post begins with a warning about disabling SMBv1, a scary warning that should cause cold, bone-chilled sweats and nightmares of a post-apocalyptic future fit for neither man nor beast; and you should read this dire warning right after reading this sentence you are now reading.

Warning

We simply cannot stress enough, even when usingBOLD UNDERLINE ALL-CAPS WARNINGSthat disabling SMBv1 in certain scenarios can lead to an almost biblical level of devastation and probably an exercise in résumé writing. Recovery will most likely require a physical visit to each machine in your organization, remote or local. There is no “undo” switch, no command in which to recover from a loss of authentication due to SMBv1 disablement (except maybe something like setting up a scheduled task to undo the change locally should things go terribly awry).

What could possibly go wrong with disabling a communication protocol that’s been around for 30 years? Here’s an incomplete list (note: some vendors are actively working on resolutions to this, so if you see this in the list, confirm with the vendor and update your application/appliance as appropriate). But first, another warning from Ned Pyle, master of the SMB over at Microsoft. He had this to add after someone asked him why he didn’t provide a script to remove SMBv1 after he authored ascathing article about how SMB1 was evil.

Products, services, and infrastructure elements that continue to use SMBv1

This is not a comprehensive list, by any means.

Currently requires SMBv1 as of this writing*:

SMBv1 enabled by default, but can (read: should) be changed to SMBv2+*:

*Some items exist in both lists, as some versions of the application/appliance are SMBv1 only and other versions are SMBv1 by default but can be modified to use SMBv2+.

Testing for SMBv1 in Your Environment:

In this, our cautionary tale, we useWiresharkto look at SMB traffic to determine what is using which SMB protocol, including SMBv1. Install Wireshark if it’s not already installed. Ideally, you will install Wireshark on a laptop so you can migrate around your site testing different VLANs or networks as necessary. Keep in mind you’re going to want to mimic what users do (authenticate with AD, print, scan to a folder, etc.) and capture how your applications communicate across the network.

NOTES:

First, fire up Wireshark and select the interface to capture:

At this point, you will be capturing all traffic the interface sees. This can get overwhelming very quickly, but we’ll be filtering this out, so no need to worry about the large amount of information you are collecting (see notes above).

When you are done testing stop your capture, throw in the filter so we only see relevant traffic, and then sort by protocol.

tcp.port eq 445 or tcp.port eq 139

This will show you all SMB and NetBIOS traffic:

After you have applied this filter, look for the protocols. Here is an example of what SMB2 looks like:

Here is an SMB negotiation packet:

IMPORTANT:The view from the capture page can be confusing, as the protocol looks at only the protocol, SMB, and not necessarily the version.

Other packets you may see in this filter includeDCERPC. When you open a DCERPC packet, you can view the SMB protocol associated with it:

You may also see theSAMRprotocol.

And finally, here’s what SMBv1 looks like:

Disable SMBv1

You’ve read the warnings, performed the testing, and are now ready to disable SMBv1.

If the warnings above were not ample enough, here’s one more.PDQ.com provides these instructions as-is, without support, or any warranty of any kind, implied or otherwise. There is absolutely no guarantee of fitness or that these instructions are in any way suitable for your, or any, environment at any time. You accept all responsibility for the use or misuse of this package, and accept any and all consequences.

Okay, that’s done. You have been warned, let us go where angels fear to tread:

1.First, open PDQ Deploy and create a new package. Call this something meaningful. Include all relevant options, including a WARNING OF TERROR for your peers.

2.Next, create a PowerShell script calledCheckServerCompatibility.ps1and place it in your PDQ Deploy Repository using the following path ($(Repository)\Disable SMBv1\CheckServerCompatibility.ps1). This script will check to make sure you do not accidentally run the package against a Domain Controller or Exchange server.

$DomainRole = (Get-WmiObject Win32_ComputerSystem).DomainRole$ExchangeSvc = Get-Service -Name MSExchangeServiceHost -ErrorAction SilentlyContinue#### Check if this is running on a domain controller and exit to avoid causing any problems on the domainif ($DomainRole -eq 4 -or $DomainRole -eq 5) { Write-Output "This machine has the Active Directory Role installed. Quitting to avoid any potential damage on this domain" exit 1}else { Write-Output "Not running on a domain controller. Continuing..."}#### Check if this is running on an Exchange server and exit to avoid angering Exchangeif ($ExchangeSvc -ne $null) { Write-Output "This machine is running an Exchange server. Exiting to avoid angering Exchange" exit 1}else { Write-Output "Not running on an Exchange server. Continuing..."}

3.Now create a PowerShell step that calls this script from the Repository. The PowerShell you will use in the PowerShell step is

& '.\CheckServerCompatibility.ps1'

And you’ll want to add the path to that file in theFilessection (make sure the Options Tab,Error Modeis set to “Stop Deployment With Error”):

4.Next, add a Command Step to add the registry key that will disable SMBv1. The command is this:

%SystemRoot%\System32\Reg.exe ADD "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" /v SMB1 /t REG_DWORD /d 0 /f

And set the following conditions in the Conditions Tab for this step:

5.Next, add another Command Step to prevent SMBv1 from starting (pre-Windows 8.1):

sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsisc.exe config mrxsmb10 start= disabled

And set the following conditions in the Conditions Tab for this step:

6.And now add another PowerShell step to disable the SMBv1 server:

Set-SmbServerConfiguration -EnableSMB1Protocol $false -force

And set the following conditions in the Conditions Tab for this step:

7.Next, add another PowerShell step to remove the Windows Feature, should it exist.

Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart

And set the following conditions in the Conditions Tab for this step:

8.Lastly, reboot all machines where you have deployed the SMBv1 disablement. Good luck and Godspeed.

Special thanks to Katie, Kris,Josh, and Colby for their significant contributions to this blog article.