Why and how to disable SMB1 on Windows 10

It is recommended to disable SMB version 1 since it is outdated and uses technology that is almost 30 years old. Says Microsoft, when you use SMB1, you lose key protections offered by later SMB protocol versions like: Pre-authentication Integrity (SMB 3.1. 1+) – Protects against security downgrade attacks.

1. Should I disable SMB1?
2. What happens if I disable SMBv1?
3. Is it safe to disable SMBv1?
4. Is it safe to enable SMB1?
5. Does disabling SMB1 break anything?
6. Is SMB secure?
7. Why is SMB1 bad?
8. Is SMBv1 enabled by default?
9. Does disabling SMBv1 require a reboot?
10. How do I disable port 445?
11. How do I uninstall SMBv1?
12. Is SMB still used?

Should I disable SMB1?

If you're not using any of these applications—and you probably aren't—you should disable SMBv1 on your Windows PC to help protect it from any future attacks on the vulnerable SMBv1 protocol. Even Microsoft recommends disabling this protocol unless you need it.

What happens if I disable SMBv1?

Disabling SMBv1 without thoroughly testing for SMBv1 traffic in your environment can have unintended consequences, up to and including a complete suspension of all network services, denied access to all resources, and remote authentication failures (like LDAP).

Is it safe to disable SMBv1?

While disabling or removing SMBv1 might cause some compatibility issues with old computers or software, SMBv1 has significant security vulnerabilities and we strongly encourage you not to use it.

Is it safe to enable SMB1?

SMB1 isn't safe

When you use SMB1, you lose key protections offered by later SMB protocol versions: Pre-authentication Integrity (SMB 3.1. 1+). Protects against security downgrade attacks.

Does disabling SMB1 break anything?

By turning off SMB1 without removing the dependency, Workstation didn't start and everything broke. Throughout the process, SMB2 and 3 were always enabled, and Microsoft does not recommend disabling them.

Is SMB secure?

The support article defined SMB as "a network file sharing and data fabric protocol" that's used by various operating systems, "including Windows, MacOS, iOS, Linux and Android." This SMB traffic can be protected at the firewall level, though.

Why is SMB1 bad?

You can't connect to the file share because it's not secure. This requires the obsolete SMB1 protocol, which is unsafe and could expose your system to attack. Your system requires SMB2 or higher. ... I mean, we're potentially leaving a big network vulnerability wide open because we use the SMB1 protocol daily.

Is SMBv1 enabled by default?

Summary. In Windows 10 Fall Creators Update and Windows Server, version 1709 (RS3) and later versions, the Server Message Block version 1 (SMBv1) network protocol is no longer installed by default. It was superseded by SMBv2 and later protocols starting in 2007. Microsoft publicly deprecated the SMBv1 protocol in 2014.

Does disabling SMBv1 require a reboot?

The cmdlet enables you to enable or disable the SMBv1, SMBv2, and SMBv3 protocols on the server component. ... This behavior occurs because these protocols share the same stack. You do not have to restart the computer after you run the Set-SMBServerConfiguration cmdlet.

How do I disable port 445?

How to Block Port 445 in Windows Firewall?

1. Go Start > Control Panel > Windows Firewall and find Advanced settings on the left side.
2. Click Inbound Rules > New rule. ...
3. Choose Block the connection > Next. ...
4. Check if you have created the rule by Properties > Protocols and Ports > Local Port.

How do I uninstall SMBv1?

Uninstall the SMBv1 protocol. Open "Windows PowerShell" with elevated privileges (run as administrator). Enter "Uninstall-WindowsFeature -Name FS-SMB1 -Restart". (Omit the Restart parameter if an immediate restart of the system cannot be done.)

Is SMB still used?

Windows SMB is a protocol used by PCs for file and printer sharing, as well as for access to remote services. A patch was released by Microsoft for SMB vulnerabilities in March 2017, but many organizations and home users have still not applied it.