To be clear, SMB V1 has been deprecated, unsecure, and not recommended for a long time. But Microsoft is now taking the next step towards removing it from Windows entirely.
Find out more
Tóm Tắt
Related Product
N-central
Manage large networks or scale IT operations with RMM made for growing service providers.
Find out more
Find out more
Related Product
N‑sight RMM
Get up and running quickly with RMM designed for smaller MSPs and IT departments.
Find out more
In recent years, Microsoft had stopped installing SMB1 server on all Windows versions by default; however, they have kept installing the SMB1 client in Home and Pro versions of Windows. This was meant to allow end users to connect to various devices, including NAS, which only supported SMB1. Microsoft was uninstalling SMB1 after 15 days of uptime on computers that didn’t use the protocol at all.
The new insider builds of Windows no longer have any version of SMB1 enabled by default. While current installs of Windows which are updated do seem to retain SMB1 functionality, at least for now.
Now, Microsoft has announced that it will be fully removing the SMB1 binaries in a future (as yet unspecified) release. This means that, in the near future, Windows and Windows Server will no longer have the ability to easily install the SMB1 client. Microsoft has said it will provide an SMB1 client that can be manually installed, but it has stated that this will be unsupported.
Now that the news is out of the way, what does this actually mean?
Finding SMB1 with automation
Probably not much for most people, but it will be important to check around and see if SMB1 is enabled on any end-user devices. Sometime ago, we published a batch file to disable SMB1 and enable SMB2, and I thought it would also be important to create a monitoring script for SMB1. To that end, I have included a script below that allows you to identify devices on which SMB1 is enabled. Depending on what RMM platform you use, you should be able to adapt it to export the information to a field, create a monitoring that will trigger a failed state if it is enabled, and possibly run the SMB1 disable script as a self-healing action.
PowerShell version: https://success.n-able.com/kb/nable_n-central/Is-SMBv1-Enabled-PowerShell
Automation Manager (AMP) version for N-able RMM: https://success.n-able.com/kb/nable_n-central/Is-SMBv1-Enabled-RMM
Automation Manager (AMP) version for N-central : https://success.n-able.com/kb/nable_n-central/Is-SMBv1-Enabled-NC
Disable SMB1 and Enable SMB2 : https://success.n-able.com/kb/nable_n-central/Disable-SMBv1-and-Enable-SMBv2
If you want to use this in your own (non-N-able) RMM, modify the script to either trigger a failure (Exit 1000 code for example) or save the value to a field, etc.
If you want to use this in N-able RMM, we recommend you upload it as a script check (as part of your DSC). The RMM version above will automatically trigger a failed state if SMB1 is enabled
If you want to use this in N-central, we recommend you upload the script to your script repository and create a custom service from it. The threshold should be whether the field contains “Enabled” or not. If it does, make the service go failed. Then, apply it to your desired devices to see where the potential problems are.
What to do if you find SMB1
Ultimately, if you find that SMB1 is enabled, you have a few options:
- Disable SMB1 in favor of SMB2 and see if anyone complains. This is a bit aggressive but will get rid of the issue.
- Contact the companies/end users who have SMB1 enabled, warn them that it will be disabled, review devices in their environment (this will most likely be required for older NAS devices), and, based on that, then disable SMB1.
- Contact the companies/end users and let them make their decision.
The good news is that you still have some time. SMB1 will remain available until this fall at least. Whenever it is disabled, you’ll have the option to re-install it manually via the provided binaries. For now, be safe, find the problematic devices, and work your way through a more secure environment.
Marc-Andre Tanguay is Head Automation Nerd at N-able. You can follow him on Twitter at @automation_nerd.
