WN16-00-000410 - The Server Message Block (SMB) v1 protocol must be uninstalled.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks and is not FIPS compliant.

Solution

Uninstall the SMBv1 protocol.

Open 'Windows PowerShell' with elevated privileges (run as administrator).

Enter 'Uninstall-WindowsFeature -Name FS-SMB1 -Restart'.
(Omit the Restart parameter if an immediate restart of the system cannot be done.)

Alternately:

Start 'Server Manager'.

Select the server with the feature.

Scroll down to 'ROLES AND FEATURES' in the right pane.

Select 'Remove Roles and Features' from the drop-down 'TASKS' list.

Select the appropriate server on the 'Server Selection' page and click 'Next'.

Deselect 'SMB 1.0/CIFS File Sharing Support' on the 'Features' page.

Click 'Next' and 'Remove' as prompted.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_Server_2016_V2R5_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000381, Rule-ID|SV-224856r569186_rule, STIG-ID|WN16-00-000410, STIG-Legacy|SV-87951, STIG-Legacy|V-73299, Vuln-ID|V-224856

Plugin: Windows

Control ID: 703c41ef0c6134099ef2cbc5217fb932bb28557257be66d7f2ff7d79d826f64e