Detections
Analytics

WN16-00-000410 - The Server Message Block (SMB) v1 protocol must be uninstalled.

Information

SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks and is not FIPS compliant.

Solution

Uninstall the SMBv1 protocol.

Open 'Windows PowerShell' with elevated privileges (run as administrator).

Enter 'Uninstall-WindowsFeature -Name FS-SMB1 -Restart'.
(Omit the Restart parameter if an immediate restart of the system cannot be done.)

Alternately:

Start 'Server Manager'.

Select the server with the feature.

Scroll down to 'ROLES AND FEATURES' in the right pane.

Select 'Remove Roles and Features' from the drop-down 'TASKS' list.

Select the appropriate server on the 'Server Selection' page and click 'Next'.

Deselect 'SMB 1.0/CIFS File Sharing Support' on the 'Features' page.

Click 'Next' and 'Remove' as prompted.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_Server_2016_V2R3_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7(4), CAT|II, CCI|CCI-000381, Rule-ID|SV-224856r569186_rule, STIG-ID|WN16-00-000410, STIG-Legacy|SV-87951, STIG-Legacy|V-73299, Vuln-ID|V-224856

Plugin: Windows

Control ID: 3ea00cebc1c63f9ac6cba7789a9d36ae5c60820c71c7b944d360dc69bfb6905e