Detections
Analytics

4.4.3 (L1) Ensure 'Configure SMB v1 server' is set to 'Disabled'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This setting configures the server-side processing of the Server Message Block version 1 (SMBv1) protocol.

The recommended state for this setting is: Disabled

Since September 2016, Microsoft has strongly encouraged that SMBv1 be disabled and no longer used on modern networks, as it is a 30 year old design that is much more vulnerable to attacks then much newer designs such as SMBv2 and SMBv3.

More information on this can be found at the following links:

Stop using SMB1 | Storage at Microsoft

Disable SMB v1 in Managed Environments with Group Policy - 'Stay Safe' Cyber Security Blog

Disabling SMBv1 through Group Policy - Microsoft Security Guidance blog

Solution

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Disabled

Administrative Templates\MS Security Guide\Configure SMB v1 server

Impact:

Some legacy OSes (e.g. Windows XP, Server 2003 or older), applications and appliances may no longer be able to communicate with the system once SMBv1 is disabled. We recommend careful testing be performed to determine the impact prior to configuring this as a widespread control, and where possible, remediate any incompatibilities found with the vendor of the incompatible system. Microsoft is also maintaining a thorough (although not comprehensive) list of known SMBv1 incompatibilities at this link:

SMB1 Product Clearinghouse | Storage at Microsoft

See Also

https://workbench.cisecurity.org/benchmarks/21719

Item Details

References: CSCv7|9.2, CSCv7|14.3

Plugin: Windows

Control ID: 4aa8b64c6eedf7b560064cc066b27e27c42ed4048ba37b09bbe3b42bdeb06c70