How to Disable SMBv1 (Server Message Block Protocol) with PowerShell

The Server Message Block Protocol (SMB) has been around for quite some time, serving as the backbone for file sharing and various other network operations. However, the earliest version, SMBv1, is now seen as a liability due to a multitude of security vulnerabilities. If you’re an IT professional or a Managed Service Provider (MSP), ensuring network security should be your paramount concern. So, how do you go about disabling SMBv1 effectively?

What Does the Script Do?

The PowerShell script at hand has been designed with a very specific purpose: to disable SMBv1 in Windows environments. It works by using a sequence of built-in PowerShell cmdlets and Registry manipulations to ensure that SMBv1 is completely disabled. The script can be executed in a Windows 10 or Windows Server 2016 environment or later, making it highly versatile and valuable for any modern Windows system.

The Script: Disable SMBv1

#Requires -Version 5.1

<#
.SYNOPSIS
    Disables SMB v1
.DESCRIPTION
    Disables SMB v1 via Get-WindowsOptionalFeature, Set-SmbServerConfiguration, or Registry
.EXAMPLE
    No parameters needed.
.EXAMPLE
    PS C:> Disable-SMBv1.ps1
    No parameters needed.
.OUTPUTS
    None
.NOTES
    Minimum OS Architecture Supported: Windows 10, Windows Server 2016
    Release Notes:
    Initial Release
By using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https://www.ninjaone.com/terms-of-use.
    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. 
    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. 
    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. 
    Warranty Disclaimer: The script is provided “as is” and “as available”, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. 
    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. 
    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. 
    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).
#>

[CmdletBinding()]
param ()

begin {
    function Test-IsElevated {
        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()
        $p = New-Object System.Security.Principal.WindowsPrincipal($id)
        if ($p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator))
        { Write-Output $true }
        else
        { Write-Output $false }
    }
    function Set-ItemProp {
        param (
            $Path,
            $Name,
            $Value,
            [ValidateSet("DWord", "QWord", "String", "ExpandedString", "Binary", "MultiString", "Unknown")]
            $PropertyType = "DWord"
        )
        # Do not output errors and continue
        $ErrorActionPreference = [System.Management.Automation.ActionPreference]::SilentlyContinue
        if (-not $(Test-Path -Path $Path)) {
            # Check if path does not exist and create the path
            New-Item -Path $Path -Force | Out-Null
        }
        if ((Get-ItemProperty -Path $Path -Name $Name)) {
            # Update property and print out what it was changed from and changed to
            $CurrentValue = Get-ItemProperty -Path $Path -Name $Name
            try {
                Set-ItemProperty -Path $Path -Name $Name -Value $Value -Force -Confirm:$false -ErrorAction Continue | Out-Null
            }
            catch {
                Write-Error $_
            }
            Write-Host "$Path$Name changed from $CurrentValue to $(Get-ItemProperty -Path $Path -Name $Name)"
        }
        else {
            # Create property with value
            try {
                New-ItemProperty -Path $Path -Name $Name -Value $Value -PropertyType $PropertyType -Force -Confirm:$false -ErrorAction Continue | Out-Null
            }
            catch {
                Write-Error $_
            }
            Write-Host "Set $Path$Name to $(Get-ItemProperty -Path $Path -Name $Name)"
        }
        $ErrorActionPreference = [System.Management.Automation.ActionPreference]::Continue
    }
    $Disable = 0
    # $Enable = 1 # Not Used
}
process {
    if (-not (Test-IsElevated)) {
        Write-Error -Message "Access Denied. Please run with Administrator privileges."
        exit 1
    }
    
    # Try using Get-WindowsOptionalFeature first
    if (-not $(Get-Command -Name "Get-WindowsOptionalFeature").Name -like "Get-WindowsOptionalFeature") {
        Write-Host "Get-WindowsOptionalFeature command not found. Continuing."
    }
    else {
        if ((Get-WindowsOptionalFeature -Online -FeatureName smb1protocol -ErrorAction SilentlyContinue).State -notlike "Disabled") {
            # Disables smb1protocol feature
            try {
                Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol
                # Disabled SMB1, exit
                exit 0
            }
            catch {
                Write-Host "smb1protocol feature not found. Continuing."
            }
        }
    }

    if (-not $(Get-Command -Name "Get-SmbServerConfiguration").Name -like "Get-SmbServerConfiguration") {
        Write-Host "Get-SmbServerConfiguration command not found. Continuing."
        $Path = "HKLM:SYSTEMCurrentControlSetServicesLanmanServerParameters"
        $Name = "SMB1"
        # https://docs.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/detect-enable-and-disable-smbv1-v2-v3#registry-editor
        # Sets SMB1 to 0
        Set-ItemProp -Path $Path -Name $Name -Value $Disable
    }
    if ((Get-SmbServerConfiguration).EnableSMB1Protocol) {
        try {
            Set-SmbServerConfiguration -EnableSMB1Protocol $false            
        }
        catch {
            Write-Host "Failed to disable SMBv1."
            exit 1
        }
    }
}
end {}

 

Security Concerns Surrounding SMBv1

SMBv1 is notorious for its security shortcomings. It has been a frequent target for various types of attacks, ransomware, and data breaches. Having SMBv1 enabled is like leaving your front door open; you’re simply inviting trouble. This PowerShell script alleviates this problem effectively by disabling SMBv1.

Time and Efficiency

Manually disabling SMBv1 can be a time-consuming task, especially in large-scale network environments. This script automates the process, saving valuable time and effort. For MSPs managing multiple clients’ networks, this tool is a godsend.

Comprehensive Approach

The script attempts to disable SMBv1 through multiple avenues, including the Get-WindowsOptionalFeature cmdlet, the Set-SmbServerConfigurationcmdlet, and direct Registry edits. This ensures that the protocol is disabled, even if one of the methods fails or is unavailable on the system in question.

How to Use the Disable SMBv1 Script

Running the script is straightforward. Here’s a quick guide:

1. Save the script into a file named Disable-SMBv1.ps1.
2. Open PowerShell as an Administrator.
3. Navigate to the folder where you saved the script.
4. Execute the script by typing PS C:> .Disable-SMBv1.ps1 and pressing Enter.

Make sure you have Administrator privileges, or the script will terminate, ensuring that you don’t accidentally make changes you shouldn’t.

Who needs this script?

• IT Professionals: If you’re in charge of maintaining a corporate network or even a smaller-scale one, this script should be part of your toolkit. With this, you can automate the process of disabling SMBv1 across multiple systems in one go.
• Managed Service Providers (MSPs): For those managing multiple clients’ networks, the ability to quickly disable vulnerable protocols like SMBv1 can add an extra layer of security, making your service more valuable to your clients.

Integrating the Script with NinjaOne

For IT professionals and Managed Service Providers (MSPs) who rely on NinjaOne as their Remote Monitoring and Management solution, incorporating this script into your regular maintenance or security protocols can add another layer of robustness to your operations.

Scheduled Execution

You can schedule the execution of the PowerShell script through NinjaOne’s Scripting Engine. By doing this, you ensure that SMBv1 gets automatically disabled on all new systems that are added to the network or any systems that get reinitialized, thereby maintaining a uniform security posture.

Monitoring and Alerts

With NinjaOne’s alerting features, you can create customized alerts that notify you when the script has run successfully or if it encounters any issues. This gives you real-time feedback, allowing you to intervene as necessary.

Remote Deployment

The Disable SMBv1 Script can be deployed remotely on multiple systems through NinjaOne. This is particularly useful for MSPs managing a wide array of networks. A few clicks can enforce a critical security policy across all your managed endpoints.

Compliance Reporting

For compliance requirements like GDPR or HIPAA, where the disabling of outdated and vulnerable protocols may be mandated, running this script through NinjaOne can provide you with a seamless way to prove that appropriate security measures are in place. NinjaOne’s reporting features can help you generate comprehensive reports for audit trails.

Final Thoughts

Disabling SMBv1 should be a no-brainer for any organization that takes network security seriously. This PowerShell script provides a reliable, efficient, and comprehensive method for doing just that. Given the critical need for heightened security protocols in today’s enterprise IT landscape, adopting this script should be a top priority.