Blog Post

Core Infrastructure and Security Blog
9 MIN READ

Active Directory Hardening Series - Part 2 – Removing SMBv1

JerryDevore's avatar
JerryDevore
Icon for Microsoft rankMicrosoft
Nov 20, 2023
Hi All!  Jerry Devore back again with another hardening Active Directory topic.  Before we jump into the technical stuff, I would like to briefly share some tips for structuring a protocol hardening ...
JerryDevore_4-1700510212575.png
Updated Nov 07, 2024
Version 5.0
ADHardening
JerryDevore
diegoaze's avatar
diegoaze
Copper Contributor
Jan 13, 2025

Thanks for the article Jerry. Very insightful, as was part 1 covering NTLMv1. Just thought I would ask you the below:

  • Similarly to part1, would it be possible to include the default status of SMB1 across the different supported versions of Windows
  • In an brand new AD domain, containing only Windows 2022/Windows 11 or newer, would we still require to take any actions regarding disabling SMB1? I understand the protocol/feature is not installed/enabled by default, but would a GPO disabling SMBv1 help in ensuring the protocol is disabled regardless?
  • In this scenario, what would be the impact of the registry key "SMB1" being set to 0/1 with the SMB1 feature installed/uninstalled?
JerryDevore's avatar
JerryDevore
Icon for Microsoft rankMicrosoft
Jan 15, 2025

SMBv1 is not installed by default starting with Windows 11, Server 2019 and build 1709 of Windows 10 and Windows server.

Given SMBv1 has to be manually added as a feature on 2022 and Windows 11, I am not sure a GPO to make sure it stays disabled is justified.  However, if you were going to create such a GPO it would need to be a GPP that does a registry punch.

A value of 0 will disable SMBv1 functionality even with the feature installed.  A value of 1 without the feature installed will not cause the device to support SMBv1.