Saturday, 13 May 2017

Disable and Remove SMB1 via ConfigMgr Compliance Settings

In the wake of the recent WannaCry worm wreaking havoc across the globe, I thought I'd knock up a quick set of Configuration Manager compliance settings and a baseline to easily disable and remove SMB1 from devices within an environment.

Just as I started to gather the information I would need about the various settings, I noticed that Alex Pooley had already documented what I was about to do.

You can find his blog post with his methods here:

There's not much value in me repeating all of the steps in this post, refer to the excellent work that Alex has already done.
However, I've made some minor changes to some of the PowerShell, set names consistently, tested it and exported it as a cab file for easy import into other environments.

Download from the TechNet Gallery here

This baseline will perform the following:
  • Disable SMB1 on Windows 8 & Server 2012 or newer
  • Remove SMB1 on Windows 8.1 & Server 2012 R2 or newer
  • Disable SMB1 Client on Windows 7 & Server 2008 R2
  • Disable SMB1 Server on Windows 7 & Server 2008 R2
Importing the cab file should give you a new folder named Security with 4 CI's within it.

These CI's are mainly using PowerShell scripts to discover and then remediate the various SMB1 configurations on the relevant Operating Systems except for the disabling of SMB1 (Server) for Windows 7/Server 2008(R2) which uses a registry value check and set.

These 4 CI's are wrapped into a Baseline called "Disable SMB1" that you can find in the folder named Security. This baseline then needs targeting at a collection that you would like to disable/remove SMB1 from.

I've run it across my estate, but I do only have 2012 R2 and Windows 10 devices. A few devices are reporting script timeout errors and I still need to dig into those further, but overall it runs fine and successfully disables SMB1.


Vamshi Krishna said...

Hai Author, Very Good informative blog post,
Thanks for Sharing

Dung Maurice said...

Best ikey monitor on the market is lies behind this link

Richard Swayar said...

Australia best tutor is well known academic portal. Here students can get different kind of Online Assignment help services like that

1.Online Assignment Help
2.Instant Assignment Help
3.Assignment Help
4.Help with Assignment assignment Help

And also access that services at any time and any where.

Riya karakoti said...

Air conditioning maintenance birmingham- onlyrepaircenter has the 30 Years Experience in Air conditioning maintenance service in birmingham. If you are facing the problem in your air conditioning of any company such as Daikin, Mitsubishi, Carrier, Fujitsu, Toshiba, Airedale, Sanyo, Trane and LG then you can contact to us.

Air Conditioning Installation birmingham
Commercial air conditioning repair Birmingham
residential air conditioning repair birmingham
Air Conditioning Maintenance birmingham
window ac repair birmingham

Riya karakoti said...

Best Digital Marketing Training Institutes in Noida - As the virtual marketing field maintains to develop at a fast pace, entrepreneurs are springing with new possibilities.

Best Php Training Institutes in Noida

Best Digital Marketing Training Institutes in Noida

Best Hadoop Training Institutes In Noida

Best Sas Training Institutes in Noida

Best Sap Training Institutes in Noida

Best Linux Training Institutes in Noida

Best Salesforce Training Institutes in Noida

Best Software Testing Training Institutes In Noida