How To Enable - Disable SMBv1, SMBv2, and SMBv3 in Windows and Windows

4/9/2019 How to enable/disable SMBv1, SMBv2, and SMBv3 in Windows and Windows Server - Security Deployment Guide| Alibaba
in Windows and Windows Server - Security Deployment Guide| Alibaba Cloud Documentation Center

 Document Center (/help) Security Advisories (/help/product/35474.htm) Security Deployment Guide (/help/f...
Impacted functionality
How to enable, and disable SMB prot...

This Prod... Search by keyword 

How to enable and disable SMB proto...
How to enable/disable SMBv1, SMBv2, and Disable SMBv1 Server with Group Poli...
SMBv3 in Windows and Windows Server Disable SMBv1 Client with Group Policy
How to gracefully remove SMB v1 in ...

Last Updated: May 08, 2018
This article describes how to enable and disable Server Message Block (SMB) version
1 (SMBv1), SMB version 2 (SMBv2), and SMB version 3 (SMBv3) on the SMB client and
server components.
Note: We do not recommend that you disable SMBv2 or SMBv3. Disable SMBv2 or
SMBv3 only as a temporary troubleshooting measure. Do not leave SMBv2 or SMBv3
disabled.
Disabling SMBv2
In Windows 7 and Windows Server 2008 R2, disabling SMBv2 deactivates the
following functionality:
Request compounding - allows to send multiple SMB 2 requests as a single

network request
Larger reads and writes - better use of faster networks
Caching of folder and le properties - clients keep local copies of folders and les
Durable handles - allow for connection to transparently reconnect to the server if
there is a temporary disconnection
Improved message signing - HMAC SHA-256 replaces MD5 as hashing algorithm
Improved scalability for le sharing - number of users, shares, and open les per
server greatly have increased
Support for symbolic links
Client oplock leasing model - limits the data transferred between the client and
server, improving performance on high-latency networks and increasing SMB
server scalability
https://www.alibabacloud.com/help/faq-detail/57499.htm 1/16
4/9/2019 How to enable/disable SMBv1, SMBv2, and SMBv3 in Windows and Windows Server - Security Deployment Guide| Alibaba Cloud Documentation Center
Large MTU support - for full use of 10-Gigabyte (GB) Ethernet
 Document Center (/help) Improved energy ef ciency - clients that have open les to a server can sleep
Disabling SMBv3 How to enable, and disable SMB prot...
In Windows 8, Windows 8.1, Windows 10, Windows Server 2012, and Windows Server How to enable and disable SMB proto...
2016, disabling SMBv3 deactivates the following functionality (and also the SMBv2
functionality that’s described in the previous list): Disable SMBv1 Server with Group Poli...
Transparent Failover - clients reconnect without interruption to cluster nodes Disable SMBv1 Client with Group Policy
during maintenance or failover
Scale Out – concurrent access to shared data on all le cluster nodes
Multichannel - aggregation of network bandwidth and fault tolerance if multiple
paths are available between client and server
SMB Direct – adds RDMA networking support for very high performance, with low
latency and low CPU utilization
Encryption – Provides end-to-end encryption and protects from eavesdropping on
untrustworthy networks
Directory Leasing - Improves application response times in branch of ces through
caching
Performance Optimizations - optimizations for small random read/write I/O
How to enable, and disable SMB protocols on

the SMB Server
For Windows 8 and Windows Server 2012

Windows 8 and Windows Server 2012 introduce the new Set-SMBServerCon guration
Windows PowerShell cmdlet. The cmdlet allows you to enable or disable the SMBv1,
SMBv2, and SMBv3 protocols on the server component.
Note: When you enable or disable SMBv2 in Windows 8 or in Windows Server 2012,
SMBv3 is also enabled or disabled. This behavior occurs because these protocols
share the same stack.
Set-SMBServerCon guration cmdlet
You do not have to restart the computer after you run the Set-SMBServerCon guration
cmdlet.
To get the current status of the SMB server protocol con guration, run the
following cmdlet:
1. Get-SmbServerConfiguration | Select EnableSMB1Protocol, EnableSMB2Protocol

 Document Center (/help)
To disable SMBv1 on the SMB server, run the following cmdlet:
1. Set-SmbServerConfiguration -EnableSMB1Protocol $false How to enable and disable SMB proto...
To disable SMBv2 and SMBv3 on the SMB server, run the following cmdlets: Disable SMBv1 Server with Group Poli...
Disable SMBv1 Client with Group Policy

1. Set-SmbServerConfiguration -EnableSMB2Protocol $false
To enable SMBv1 on the SMB server, run the following cmdlet:
1. Set-SmbServerConfiguration -EnableSMB1Protocol $true
To enable SMBv2 and SMBv3 on the SMB server, run the following cmdlet:
1. Set-SmbServerConfiguration -EnableSMB2Protocol $true
For Windows 7, Windows Server 2008 R2, Windows

Vista, and Windows Server 2008
To enable or disable SMB protocols on an SMB Server that is running Windows 7,
Windows Server 2008 R2, Windows Vista, or Windows Server 2008, use Windows
PowerShell or Registry Editor.
PowerShell methods
Note: This method requires PowerShell 2.0 or later version of PowerShell.
To disable SMBv1 on the SMB server, run the following cmdlet:
1. Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Paramet
ers" SMB1 -Type DWORD -Value 0 -Force
To disable SMBv2 and SMBv3 on the SMB server, run the following cmdlets:
To enable SMBv1 on the SMB server, run the following cmdlet:


ers" SMB1 -Type DWORD -Value 1 -Force Impacted functionality

To enable SMBv2 and SMBv3 on the SMB server, run the following cmdlet:
Disable SMBv1 Server with Group Poli...

Note: You must restart the computer after you make these changes.
Registry Editor
Note: This following content contains information about how to modify the registry.
Make sure that you back up the registry before you modify it. Make sure that you know
how to restore the registry if a problem occurs. For more information about how to
back up, restore, and modify the registry, see How to back up and restore the registry
in Windows (https://support.microsoft.com/en-us/help/322756).
To enable or disable SMBv1 on the SMB server, con gure the following registry
key:
Registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parame
ters
Registry entry: SMB1
REG_DWORD: 0 = Disabled
REG_DWORD: 1 = Enabled
Default: 1 = Enabled (No registry key is created)
To enable or disable SMBv2 on the SMB server, con gure the following registry
key:
Registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parame
ters
Registry entry: SMB2

REG_DWORD: 0 = Disabled
REG_DWORD: 1 = Enabled
Default: 1 = Enabled (No registry key is created)
Note: You must restart the computer after you make these changes
How to enable and disable SMB protocols on the

SMB Client Impacted functionality

For Windows Vista, Windows Server 2008, Windows 7,
Windows Server 2008 R2, Windows 8, and Windows How to enable and disable SMB proto...
Server 2012 Disable SMBv1 Server with Group Poli...
Note: When you enable or disable SMBv2 in Windows 8 or in Windows Server 2012, Disable SMBv1 Client with Group Policy
SMBv3 is also enabled or disabled. This behavior occurs because these protocols
share the same stack. How to gracefully remove SMB v1 in ...
To disable SMBv1 on the SMB client, run the following command:
1. sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi
2. sc.exe config mrxsmb10 start= disabled
To enable SMBv1 on the SMB client, run the following command:
1. sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi
2. sc.exe config mrxsmb10 start= auto
To disable SMBv2 and SMBv3 on the SMB client, run the following command:
1. sc.exe config lanmanworkstation depend= bowser/mrxsmb10/nsi
2. sc.exe config mrxsmb20 start= disabled
To enable SMBv2 and SMBv3 on the SMB client, run the following command:
1. sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi
2. sc.exe config mrxsmb20 start= auto
Note:
You must run these commands at an elevated command prompt.
You must restart the computer after you make these changes.
Disable SMBv1 Server with Group Policy

This con gures the following new item in the registry

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters Impacted functionality
Registry entry: SMB1 REG_DWORD: 0 = Disabled How to enable, and disable SMB prot...
Procedure How to enable and disable SMB proto...
To con gure this using Group Policy: Disable SMBv1 Server with Group Poli...
1. Open the Group Policy Management Console. Right-click the Group Policy object Disable SMBv1 Client with Group Policy
(GPO) that must contain the new preference item, and then click Edit.
2. In the console tree under Computer Con guration, expand the Preferences
folder, and then expand the Windows Settings folder.
3. Right-click the Registry node, point to New, and select Registry Item.
4. In the New Registry Properties dialog box, select the following:
Action: Create
Hive: HKEY_LOCAL_MACHINE
Key Path: SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
Value name: SMB1
Value type: REG_DWORD
Value data: 0

5. This disables the SMBv1 Server components. This Group Policy must be applied
to all necessary workstations, servers, and domain controllers in the domain.
Note: Be careful when making these changes on domain controllers where legacy
Windows XP or older Linux and 3rd party systems (that do not support SMBv2 or
SMBv3) require access to SYSVOL or other le shares where SMB v1 is being
disabled.

To disable the SMBv1 client, the services registry key must be updated to disable the
start of MRxSMB10 and then the dependency on MRxSMB10 must be removed from
the entry for LanmanWorkstation so that it can start normally without requiring
MRxSMB10 to rst start.
This updates and replaces the default values in the following 2 items in the registry
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\mrxsmb10
Registry entry: Start REG_DWORD: 4 = Disabled
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation
Registry entry: DependOnService REG_MULTI_SZ: “Bowser”,”MRxSmb20″,”NSI”

Note: The default included MRxSMB10 which is now removed as dependency

Procedure
To con gure this using Group Policy:

1. Open the Group Policy Management Console. Right-click the Group Policy object
(GPO) that must contain the new preference item, and then click Edit.
2. In the console tree under Computer Con guration, expand the Preferences
folder, and then expand the Windows Settings folder.

3. Right-click the Registry node, point to New, and select Registry Item.
Action: Update
Key Path: SYSTEM\CurrentControlSet\services\mrxsmb10
Value name: Start
Value type: REG_DWORD
Value data: 4

Then remove the dependency on the MRxSMB10 that was just disabled
Action: Replace
Key Path: SYSTEM\CurrentControlSet\Services\LanmanWorkstation
Value name: DependOnService
Value type REG_MULTI_SZ
Value data:
Bowser
MRxSmb20
NSI
Note: These 3 strings do not have bullets (see below)

The default value includes MRxSMB10 in many versions of Windows, so by replacing

them with this multi-value string, it is in effect removing MRxSMB10 as a dependency
for LanmanServer and going from four default values down to only these three
preceding values.
Note: When using Group Policy Management Console, there is no need to use
quotation marks or commas. Just type the each entry on individual lines as shown
above.
Restart Requirement
After the policy has applied and the registry settings are in place, you have to restart
the system before SMB v1 is disabled.
Summary
If all the settings are in the same Group Policy Object (GPO), Group Policy
Management shows the settings below.

Testing and Validation How to gracefully remove SMB v1 in ...
Once these are con gured, allow the policy to replicate and update. As necessary for
testing, run gpupdate /force from a CMD.EXE prompt and then review the target
machines to make sure that the registry settings are getting applied correctly. Make
sure SMB v2 and SMB v3 is functioning for all other systems in the environment.
Note: You must restart the targeted systems.
How to gracefully remove SMB v1 in Windows

8.1, Windows 10, Windows 2012 R2, and
Windows Server 2016
Windows Server 2012 R2 and Windows Server 2016:

Server Manager method for disabling SMB

Windows Server 2012 R2 & 2016: PowerShell methods

(Remove-WindowsFeature FS-SMB1)
Windows 8.1 and Windows 10: Add or Remove Programs

method

Windows 8.1 and Windows 10: Powershell method

(Disable-WindowsOptionalFeature -Online -
FeatureName smb1protocol)
 Previous: Harden Rsync (/help/doc-detail/51079.htm)

Next: Harden Docker service  (/help/doc-detail/60789.htm)
Still have questions? Ask our community.
(https://s (https://w (https://s

cloud) Cloud-1) cloud)
Join our Community Builder Program

(https://www.alibabacloud.com/campaign/communitybuilder) and get
rewarded. Impacted functionality

Help us improve this document.
(https://g

Join our Open Source Project (https://www.alibabacloud.com/campaign/doc-
opensource) and become an of cial content contributor! How to gracefully remove SMB v1 in ...
How is this documentation help?
Free Trial (https://account.alibabacloud.com/register/intl_register.htm)
About Promotions Explore Support Resources
About Alibaba Cloud Free Trial China Gateway Contact Sales Documentation
A comprehensive
(https://www.alibabacloud.com/about)
(https://www.alibabacloud.com/campaign/free-
(https://www.alibabacloud.com/china-
(https://www.alibabacloud.com/contact-
Center
suite of global
Pricing Models trial) gateway) sales) (https://www.alibabacloud.com/help)
cloud computing
(https://www.alibabacloud.com/pricing)
Refer a Friend ICP License Support Submit a Ticket Alibaba Cloud MVP services to power
Products (https://www.alibabacloud.com/campaign/referral)
(https://www.alibabacloud.com/icp)
(https://account.alibabacloud.com/login/login.htm? your business
(https://www.alibabacloud.com/mvp)
(https://www.alibabacloud.com/product)
Starter Package Getting Started lang=&oauth_callback=http%3A//workorder-
Security &
  
Customers (https://www.alibabacloud.com/starter-
(https://www.alibabacloud.com/getting-
intl.console.aliyun.com/console.htm%3Flang%3D%23)
Compliance
(https://www.facebook.com/alibabacloud/)
(//www.linkedin.com/company/alibaba-
(//www.twitter.com/alibaba_cloud)
(https://www.alibabacloud.com/customers)
packages/general) started) After-Sales Support (https://www.alibabacloud.com/trust-
cloud-
Partners Web Hosting Blog (https://www.alibabacloud.com/support/after-
center)
(//plus.google.com/113352360570257060531
computing-
(https://www.alibabacloud.com/partner)
(https://www.alibabacloud.com/product/hosting)
(https://www.alibabacloud.com/blog)
sales) Press Room
Startups Af liate Program Marketplace Report Abuse company)
(https://www.alibabacloud.com/press-
(https://www.alibabacloud.com/startup)
(https://www.alibabacloud.com/af
(https://marketplace.alibabacloud.com/)
liate) (https://www.alibabacloud.com/report)
room)
The Computing Training & Forum WHOIS

Conference Certi cation (https://www.alibabacloud.com/forum)
(https://www.alibabacloud.com/whois)
(https://www.alibabacloud.com/the- (https://www.alibabacloud.com/support/tutor-
Pricing Calculator Site Map
computing- program) (https://www.alibabacloud.com/pricing-
(https://www.alibabacloud.com/sitemap.html)
conference-2018/) calculator) How to enable and disable SMB proto...

Alibaba Cloud
Summit
(https://www.alibabacloud.com/in nity- Disable SMBv1 Client with Group Policy
2018)
Products & Solutions Elastic Compute Service (https://www.alibabacloud.com/product/ecs)
CDN (https://www.alibabacloud.com/product/cdn)
Anti-DDoS Basic (https://www.alibabacloud.com/products/ddosdip)
Object Storage Service (https://www.alibabacloud.com/product/oss)
eCommerce (https://www.alibabacloud.com/solutions/e-commerce)
Web Hosting (https://www.alibabacloud.com/solutions/hosting)
Security (https://www.alibabacloud.com/solutions/security)
Hot Content Japan Site (https://jp.alibabacloud.com/)
ECS Documentation (https://www.alibabacloud.com/help/product/25365.htm)
How to get Domains (https://www.alibabacloud.com/domain)
Galaxy Program (https://www.alibabacloud.com/campaign/galaxy-program)
Software Infrastructure (https://marketplace.alibabacloud.com/products/56682004)
Learning Path (https://www.alibabacloud.com/getting-started/learningpath)
New Users (https://www.alibabacloud.com/getting-started/projects)
Recommended Topic Center (https://topic.alibabacloud.com)
Cloud Computing (https://topic.alibabacloud.com/c/cloud-computing_3)
Industries (https://topic.alibabacloud.com/c/industries_2)
Developers (https://topic.alibabacloud.com/c/developer_1)
Web Developing (https://topic.alibabacloud.com/c/web-develop_1_11_1)
Tutorials (https://topic.alibabacloud.com/c/tutorials_4)
PHP Tutorials (https://topic.alibabacloud.com/c/php-tutorials_4_86_1) Impacted functionality
Browse by Letter A (https://topic.alibabacloud.com/zqpop/a) B (https://topic.alibabacloud.com/zqpop/b)

C (https://topic.alibabacloud.com/zqpop/c) D (https://topic.alibabacloud.com/zqpop/d)
E (https://topic.alibabacloud.com/zqpop/e) F (https://topic.alibabacloud.com/zqpop/f)
G (https://topic.alibabacloud.com/zqpop/g) H (https://topic.alibabacloud.com/zqpop/h)
I (https://topic.alibabacloud.com/zqpop/i) J (https://topic.alibabacloud.com/zqpop/j)
K (https://topic.alibabacloud.com/zqpop/k) L (https://topic.alibabacloud.com/zqpop/l) How to gracefully remove SMB v1 in ...
M (https://topic.alibabacloud.com/zqpop/m) N (https://topic.alibabacloud.com/zqpop/n)
O (https://topic.alibabacloud.com/zqpop/o) P (https://topic.alibabacloud.com/zqpop/p)
Q (https://topic.alibabacloud.com/zqpop/q) R (https://topic.alibabacloud.com/zqpop/r)
S (https://topic.alibabacloud.com/zqpop/s) T (https://topic.alibabacloud.com/zqpop/t)
U (https://topic.alibabacloud.com/zqpop/u) V (https://topic.alibabacloud.com/zqpop/v)
W (https://topic.alibabacloud.com/zqpop/w) X (https://topic.alibabacloud.com/zqpop/x)
Y (https://topic.alibabacloud.com/zqpop/y) Z (https://topic.alibabacloud.com/zqpop/z)
0-9 (https://topic.alibabacloud.com/zqpop/0-9)
Careers (https://www.alibabacloud.com/careers) About Us (//www.alibabacloud.com/about)

Privacy Policy (https://www.alibabacloud.com/help/en/faq-detail/42425.htm)
Legal (//www.alibabacloud.com/help/product/42384.htm) Notice List (//www.alibabacloud.com/notice)
Links (https://www.alibabacloud.com/links.html)
Alibaba Group (http://www.alibabagroup.com/en/global/home) Taobao Marketplace (//www.taobao.com/) Tmall (//www.tmall.com/)

Juhuasuan (//ju.taobao.com/) AliExpress (http://www.aliexpress.com/) Alibaba.com (http://www.alibaba.com/) 1688 (http://www.1688.com/)
Alimama (http://www.alimama.com/index.htm) Fliggy (https://www. iggy.com/) YunOS (http://www.yunos.com/)
AliTelecom (http://www.aliqin.cn/) AutoNavi (http://www.autonavi.com/) UCWeb (http://www.ucweb.com/) Umeng (http://www.umeng.com/)
Xiami (http://www.xiami.com/) DingTalk (http://www.dingtalk.com/?lwfrom=20150205111943449) Alipay (https://www.alipay.com/)
© 2009-2019 Copyright by Alibaba Cloud All rights reserved

How To Enable - Disable SMBv1, SMBv2, and SMBv3 in Windows and Windows

Transféré par

Informations du document

Titre original

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

How To Enable - Disable SMBv1, SMBv2, and SMBv3 in Windows and Windows

Transféré par

Droits d'auteur :

Formats disponibles

4/9/2019 How to enable/disable SMBv1, SMBv2, and SMBv3 in Windows and Windows Server - Security Deployment Guide| Alibaba

How to enable, and disable SMB prot...

How to gracefully remove SMB v1 in ...

Request compounding - allows to send multiple SMB 2 requests as a single

Large MTU support - for full use of 10-Gigabyte (GB) Ethernet

Disabling SMBv3 How to enable, and disable SMB prot...

How to enable, and disable SMB protocols on

For Windows 8 and Windows Server 2012

Set-SMBServerCon guration cmdlet

1. Get-SmbServerConfiguration | Select EnableSMB1Protocol, EnableSMB2Protocol

1. Set-SmbServerConfiguration -EnableSMB1Protocol $false How to enable and disable SMB proto...

Disable SMBv1 Client with Group Policy

To enable SMBv1 on the SMB server, run the following cmdlet:

1. Set-SmbServerConfiguration -EnableSMB1Protocol $true

1. Set-SmbServerConfiguration -EnableSMB2Protocol $true

For Windows 7, Windows Server 2008 R2, Windows

Note: This method requires PowerShell 2.0 or later version of PowerShell.

To disable SMBv1 on the SMB server, run the following cmdlet:

1. Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Paramet

ers" SMB1 -Type DWORD -Value 0 -Force

1. Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Paramet

ers" SMB2 -Type DWORD -Value 0 -Force

To enable SMBv1 on the SMB server, run the following cmdlet:

1. Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Paramet

How to enable, and disable SMB prot...

Disable SMBv1 Client with Group Policy

Registry entry: SMB1

Registry entry: SMB2

How to enable and disable SMB protocols on the

How to enable, and disable SMB prot...

Server 2012 Disable SMBv1 Server with Group Poli...

To disable SMBv1 on the SMB client, run the following command:

1. sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi

2. sc.exe config mrxsmb10 start= disabled

To enable SMBv1 on the SMB client, run the following command:

1. sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi

2. sc.exe config mrxsmb10 start= auto

1. sc.exe config lanmanworkstation depend= bowser/mrxsmb10/nsi

2. sc.exe config mrxsmb20 start= disabled

1. sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi

2. sc.exe config mrxsmb20 start= auto

You must run these commands at an elevated command prompt.

Disable SMBv1 Server with Group Policy

This con gures the following new item in the registry

 Document Center (/help)

Procedure How to enable and disable SMB proto...

4. In the New Registry Properties dialog box, select the following:

Key Path: SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

Value name: SMB1

Value type: REG_DWORD

 Document Center (/help)

How to enable, and disable SMB prot...

How to enable and disable SMB proto...

Disable SMBv1 Server with Group Poli...

Disable SMBv1 Client with Group Policy

How to gracefully remove SMB v1 in ...

Disable SMBv1 Client with Group Policy

Registry entry: Start REG_DWORD: 4 = Disabled

Registry entry: DependOnService REG_MULTI_SZ: “Bowser”,”MRxSmb20″,”NSI”

Note: The default included MRxSMB10 which is now removed as dependency

 Document Center (/help)

How to enable and disable SMB proto...

How to gracefully remove SMB v1 in ...