Mastering Windows SMB Server: Enabling, Disabling, and Optimizing SMBv1, SMBv2, and SMBv3

Server Message Block (SMB) protocol is the backbone of file sharing in Windows environments. Understanding how to manage different SMB versions on your Windows Smb Server is crucial for performance, compatibility, and most importantly, security. This guide dives deep into detecting, enabling, and disabling SMBv1, SMBv2, and SMBv3 protocols on Windows Server and client operating systems, ensuring your network is both efficient and secure.

While SMBv1 served its purpose in older networks, it’s now considered a security risk due to known vulnerabilities. Modern SMB versions like SMBv2 and SMBv3 offer significant improvements in speed, features, and security. This article will equip you with the knowledge to confidently manage SMB versions on your Windows SMB server, optimizing it for today’s demands while mitigating potential threats.

Understanding SMB Protocol Versions: A Quick Overview

Before we delve into the practical steps, let’s briefly understand the evolution of SMB versions:

• SMBv1: The legacy protocol, while still functional in some older systems, is outdated and riddled with security flaws. Microsoft strongly recommends disabling SMBv1 due to these vulnerabilities.
• SMBv2: Introduced with Windows Vista and Windows Server 2008, SMBv2 brought significant enhancements in performance and security over SMBv1. It introduced features like request compounding, larger read/write operations, and improved caching.
• SMBv3: Debuting with Windows 8 and Windows Server 2012, SMBv3 further enhanced security and performance. Key features include encryption, SMB Direct with RDMA support, and multichannel capabilities for increased bandwidth and resilience.

Disabling SMBv1 is a critical security measure, but temporarily disabling SMBv2 or SMBv3 might be necessary for troubleshooting specific compatibility issues. However, it’s generally recommended to keep the latest versions enabled to leverage their advanced features and security benefits.

In Windows 10 and later, and Windows Server 2019 and later, SMBv1 is not installed by default, except for Home and Pro editions of Windows 10. For optimal security and performance, updating legacy SMB servers that still require SMBv1 is highly recommended instead of re-enabling the outdated protocol.

Why Disabling SMBv1 on Your Windows SMB Server is Crucial

SMBv1’s vulnerabilities are well-documented, making it a prime target for exploits like the WannaCry ransomware. Continuing to use SMBv1 exposes your Windows SMB server and entire network to significant security risks. By disabling SMBv1, you proactively close a major security gap, safeguarding your data and systems from potential attacks.

Furthermore, modern operating systems and applications are designed to work seamlessly with SMBv2 and SMBv3. Disabling SMBv1 often improves overall network performance by encouraging clients to use more efficient and secure protocols.

Detecting, Enabling, and Disabling SMB Protocols on Windows Server

Let’s explore the methods to manage SMB versions on your Windows SMB server. We’ll cover PowerShell, Server Manager, and Registry Editor methods.

Using PowerShell to Manage SMB Versions on Windows Server

PowerShell provides a powerful and efficient way to manage SMB versions.

Detect SMBv1 Status:

Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

This command checks if the SMBv1 feature is enabled or disabled on your server.

Disable SMBv1:

Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

Executing this command will disable SMBv1. A server restart is required for the changes to take effect.

Enable SMBv1 (Not Recommended):

Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

This command re-enables SMBv1. Use this command only if absolutely necessary and understand the security implications. A server restart is also needed.

Quickly Detect SMBv1 Server Status:

For a quick status check without elevation, use:

Get-SmbServerConfiguration | Format-List EnableSMB1Protocol

Managing SMBv1, SMBv2, and SMBv3 using Set-SmbServerConfiguration Cmdlet:

This cmdlet offers granular control over SMB protocol versions.

Detect SMBv1 Server Protocol Status:

Get-SmbServerConfiguration | Select EnableSMB1Protocol

Disable SMBv1 Server Protocol:

Set-SmbServerConfiguration -EnableSMB1Protocol $false

Enable SMBv1 Server Protocol (Not Recommended):

Set-SmbServerConfiguration -EnableSMB1Protocol $true

Detect SMBv2/v3 Server Protocol Status:

Get-SmbServerConfiguration | Select EnableSMB2Protocol

Disable SMBv2/v3 Server Protocol:

Set-SmbServerConfiguration -EnableSMB2Protocol $false

Enable SMBv2/v3 Server Protocol:

Set-SmbServerConfiguration -EnableSMB2Protocol $true

Important Note: When you disable SMBv2 using Set-SmbServerConfiguration, SMBv3 is also disabled as they share the same protocol stack in Windows 8 and Windows Server 2012 and later. You do not need to restart the server after using Set-SmbServerConfiguration.

Removing SMBv1 using Server Manager (Windows Server 2012, 2012 R2, 2016, 2019, and later)

For a graphical interface approach, Server Manager provides a straightforward way to remove SMBv1.

1. Open Server Manager Dashboard.
2. Click Add roles and features.
3. Select Next on the “Before you begin” page.
4. Choose Select destination server and ensure your server is selected. Click Next.
5. On the Remove server roles page, click Next.
6. On the Remove features page, uncheck SMB 1.0/CIFS File Sharing Support.
7. Click Next and then Remove on the confirmation page.

Using Registry Editor to Manage SMB Versions (Windows 7, Windows Server 2008 R2, and Older)

For older systems, Registry Editor can be used to manage SMB versions. Exercise caution when modifying the registry. Back up your registry before making changes.

Disable SMBv1 on SMB Server via Registry:

1. Open Registry Editor (regedit.exe).
2. Navigate to: HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesLanmanServerParameters
3. Create a new DWORD (32-bit) Value named SMB1.
4. Set the Value data to 0 to disable SMBv1. To enable (not recommended), set it to 1. If the value doesn’t exist, SMBv1 is enabled by default.
5. Restart your server.

Disable SMBv2/v3 on SMB Server via Registry:

1. Open Registry Editor (regedit.exe).
2. Navigate to: HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesLanmanServerParameters
3. Create a new DWORD (32-bit) Value named SMB2.
4. Set the Value data to 0 to disable SMBv2/v3. To enable, set it to 1. If the value doesn’t exist, SMBv2/v3 is enabled by default.
5. Restart your server.

Managing SMB Versions on Windows Client Operating Systems

Now, let’s look at managing SMB versions on Windows client machines (Windows 10, Windows 11, Windows 8.1, Windows 7, etc.).

Using “Windows Features” to Disable SMBv1 (Windows 8.1, Windows 10, Windows 11)

The “Windows Features” dialog provides a user-friendly way to disable SMBv1 on client operating systems.

1. Open Control Panel and navigate to Programs.
2. Click Turn Windows features on or off under “Programs and Features”.
3. In the “Windows Features” dialog, uncheck SMB 1.0/CIFS File Sharing Support.
4. Click OK and Restart now when prompted.

Using Command Prompt to Manage SMB Versions on Windows Client

Command Prompt offers a way to manage SMB versions on client systems using sc.exe commands. Run Command Prompt as administrator.

Detect SMBv1 Client Status:

sc.exe qc lanmanworkstation

Disable SMBv1 Client:

sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi
sc.exe config mrxsmb10 start= disabled

Enable SMBv1 Client (Not Recommended):

sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi
sc.exe config mrxsmb10 start= auto

Detect SMBv2/v3 Client Status:

sc.exe qc lanmanworkstation

Disable SMBv2/v3 Client:

sc.exe config lanmanworkstation depend= bowser/mrxsmb10/nsi
sc.exe config mrxsmb20 start= disabled

Enable SMBv2/v3 Client:

sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi
sc.exe config mrxsmb20 start= auto

Restart your computer after running these commands.

Using Registry Editor on Windows Client (Similar to Server)

The registry method for disabling SMBv1 and SMBv2/v3 on Windows client is essentially the same as described for Windows Server. Navigate to the same registry paths (HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesLanmanServerParameters) and create/modify the SMB1 and SMB2 DWORD values as needed. Remember to restart your computer after making changes.

Disabling SMBv1 Using Group Policy for Domain-Wide Management

For organizations managing multiple Windows systems in a domain, Group Policy provides a centralized and scalable way to disable SMBv1 across the network.

Disable SMBv1 Server Component via Group Policy:

1. Open Group Policy Management Console (gpmc.msc).
2. Edit an existing GPO or create a new one.
3. Navigate to: Computer Configuration > Preferences > Windows Settings > Registry.
4. Right-click Registry, select New > Registry Item.
5. In the “New Registry Properties” dialog:
   • Action: Create
   • Hive: HKEY_LOCAL_MACHINE
   • Key Path: SYSTEMCurrentControlSetServicesLanmanServerParameters
   • Value name: SMB1
   • Value type: REG_DWORD
   • Value data: 0

Disable SMBv1 Client Component via Group Policy:

1. In the same GPO, create two new Registry Items:

   • First Registry Item (Disable MRxSMB10 Service):

     • Action: Update
     • Hive: HKEY_LOCAL_MACHINE
     • Key Path: SYSTEMCurrentControlSetservicesmrxsmb10
     • Value name: Start
     • Value type: REG_DWORD
     • Value data: 4

   • Second Registry Item (Remove MRxSMB10 Dependency from LanmanWorkstation):

     • Action: Replace
     • Hive: HKEY_LOCAL_MACHINE
     • Key Path: SYSTEMCurrentControlSetServicesLanmanWorkstation
     • Value name: DependOnService
     • Value type: REG_MULTI_SZ
     • Value data (Enter each on a new line):

       Bowser
       MRxSmb20
       NSI

2. Link the GPO to the appropriate Organizational Units (OUs) containing your servers and workstations.

3. Allow Group Policy to replicate and update. You can force an update on target machines using gpupdate /force in Command Prompt.

4. Restart the targeted systems.

Auditing SMBv1 Usage to Identify Legacy Systems

Before permanently disabling SMBv1, auditing its usage can help identify legacy systems that might still rely on it. Windows Server 2016, Windows 10, and Windows Server 2019 and later support SMBv1 auditing.

Enable SMBv1 Auditing:

Set-SmbServerConfiguration -AuditSmb1Access $true

Disable SMBv1 Auditing:

Set-SmbServerConfiguration -AuditSmb1Access $false

Detect SMBv1 Auditing Status:

Get-SmbServerConfiguration | Select AuditSmb1Access

When auditing is enabled, Event ID 3000 will be logged in the Microsoft-Windows-SMBServerAudit event log whenever a client attempts to connect using SMBv1. Review these logs to identify and update legacy systems before fully disabling SMBv1.

Conclusion: Securing and Optimizing Your Windows SMB Server

Managing SMB protocol versions is a vital aspect of maintaining a secure and efficient Windows network. Disabling SMBv1 is a critical security best practice that should be implemented across your environment. By utilizing the methods outlined in this guide, you can confidently detect, disable, and manage SMB versions on both Windows Server and client systems, strengthening your network’s security posture and optimizing its performance. Embrace modern SMB protocols like SMBv2 and SMBv3 to leverage their enhanced features and ensure a robust and secure file-sharing infrastructure. Remember to always test changes in a controlled environment and thoroughly validate functionality after implementing SMB version modifications.