Disabling SMBv1 through Group Policy

Version 1 of the Server Message Block (SMB) protocol was developed in the early days of personal computer networking, and as Ned Pyle describes in his blog post, Stop using SMB1 there are many reasons to cease using it on your networks. We have added that recommendation to our baseline, and have exposed a way to do so through Group Policy editors for local or domain GPOs by adding to the custom “MS Security Guide” ADMX. That said, the settings that need to be manipulated are not a natural fit for GPO management, so you need to be careful while using it. Applying settings incorrectly can cause serious problems.

We wanted these custom settings to work for all supported versions of Windows and to be reversible so that SMBv1 could be re-enabled if necessary. Due to the limitations of the ADMX syntax, we ended up implementing it through three separate settings:

• Configure SMB v1 server, to disable or enable server-side processing of the SMBv1 protocol. This is a simple Enabled/Disabled/Not Configured setting that controls the “SMB1” registry value in HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters.
• Configure SMB v1 client driver, to configure the startup mode for the kernel mode driver that implements client-side SMBv1 processing (MrxSmb10). This setting includes a dropdown that is activated when the Enabled radio button is selected and that controls the “Start” registry value in HKLM\SYSTEM\CurrentControlSet\Services\MrxSmb10. Note that choosing the “Disabled” radio button deletes the “Start” value, so don’t do that! See the explain text shown in the table below if you need to restore default behavior. Note that the “Disabled” radio button is not the same thing as the dropdown value, “Disable driver (recommended).”
• Configure SMB v1 client (extra setting…) , which is needed only for older Windows versions. This setting controls the “DependOnService” REG_MULTI_SZ value in HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation, which represents the service and driver dependencies of the Workstation service (internal name: LanmanWorkstation). Older versions of Windows configure LanmanWorkstation with a dependency on the SMBv1 client driver (MrxSmb10) running, which can be problematic if MrxSmb10 is disabled. So this setting enables you to configure the LanmanWorkstation service’s dependencies directly. The setting’s Explain text describes exactly what to enter into the text box. Unfortunately, there is no way for the ADMX to offer a choice of predefined REG_MULTI_SZ values. You have to type – or copy/paste – the text yourself. And here again, choosing the “Disabled” radio button deletes the DependOnService value, which would be very bad, so don’t do that!

This table lists the settings and corresponding explain text from the Group Policy editor:

You can obtain the "MS Security Guide" ADMX template in the download associated with the draft baseline for Windows 10 v1703 here. Copy SecGuide.admx into your %windir%\PolicyDefinitions directory, and copy SecGuide.adml into the en-us subdirectory.

Comments

• Anonymous
  June 15, 2017
  It would be helpful to include a link to where you get the “MS Security Guide” ADMX.[Aaron Margosis] Thanks. I'll update the post with that information. In the meantime, it's in the download package with the draft baseline here.[Aaron Margosis] Updated.
  • Anonymous
    June 19, 2017
    I've opened the Windows-10-RS2-Security-Baseline package and while the Policy seems to contain some SMBv1 settings, the ADMX templates included in the package do not seem to contain some of the above definitions, such as "Configure SMB v1 client (extra setting needed for pre-Win8.1/2012R2)"[Aaron Margosis] Copy the *.ADMX files to the %windir%\PolicyDefinitions directory, and the *.ADML files to the en-us subdirectory. If the Group Policy editor is open, close it and then re-open.
  • Anonymous
    June 23, 2017
    Thank-you!
• Anonymous
  June 16, 2017
  The comment has been removed
• Anonymous
  June 18, 2017
  Thank you, Group Policy for disabling SMBv1.I hope which ADMX file need to disable SMBv1.Is it SecGuide.admx ?[Aaron Margosis] Yes. Put SecGuide.admx in the %windir%\PolicyDefinitions directory and SecGuide.adml in the en-us subdirectory.
• Anonymous
  June 20, 2017
  Can you confirm whether setting the "Configure LanmanWorkstation dependencies" as described above will NOT have any impact on Windows 8 (and server 2012R") and above. i.e. if the above settings are applied in a generic policy for all Windows OS client version or do they need to be specifically segregated.[Aaron Margosis] You should segregate them, and not apply the "extra setting needed for pre-Win8.1/2012R2" to Win8.1/2012R2 or newer.
• Anonymous
  June 20, 2017
  For the two settings with "WARNING: DO NOT SELECT THE “DISABLED” RADIO BUTTON UNDER ANY CIRCUMSTANCES!" what is the behavior when going from 'Enabled' to 'Not Configured'?[Aaron Margosis] The last-applied settings should remain in place -- "tattooed."
• Anonymous
  June 28, 2017
  The comment has been removed
• Anonymous
  June 29, 2017
  I've applied a new GPO to my test ou.Can I confirm that once this Group Policy is applied the SMBv1 flag within "Turn on-turn Off Windows Features" will remain in place?Is there a way to confirm that the Policy has in fact disabled SMBv1 on the client.I was hoping to use this as opposed to the Powershell method.
• Anonymous
  July 13, 2017
  The "Supported On" section of these settings says at least Windows 2008/7. Sounds like a mistake.[Aaron Margosis] You are correct. It should be all supported OSes, which is Win7 and newer, and Server 2008 and newer.
• Anonymous
  August 30, 2017
  The comment has been removed
• Anonymous
  October 13, 2017
  I have a GPO for Windows 2012 R2 and 2016 on which I configured the 2 respective settings to disable SMB1 Server and Client. Is it a problem if some of these servers also have SMB1 actually uninstalled as a Windows feature?[Aaron Margosis] Should not be a problem.
• Anonymous
  November 29, 2017
  Hi - I've added in secguide.admx and secguide to the correct directories above ( %windir%\PolicyDefinitions and en-us subdirectory) and still do not see option to enable these features - have shutdown Group Policy Manager