New
#1
Enabling network sharing with smb1 disabled and smb2 enabled
We all know about how people at microsoft make smbv1 mandatory to share folder across a local network, which exposes us to ransomwares. people at Microsoft have no concerns for security, despite being in IT business for the last 30 years....
in windows 10 , like 1809, the trick is to enable smbv2 and disable smbv1, but like they say here it prevents some background process to start SMB1 disabled, SMB2 enabled; Can no longer access network shares
Fortunately i found a blog on how to get file sharing securely
first put back the windows firewall to default settings, to be sure
just to be sure, get those two new services enabled
get-Service fdPHost,FDResPub|Set-Service -startuptype automatic -passthru|Start-Service
then follow all those lines Mapped network printers unavailable due to SMB1 being obsolete – Xenit Technical
Enable SMB v2 Client
sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi
sc.exe config mrxsmb20 start= auto
Enable SMB v2 Server
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB2 -Type DWORD -Value 1 –Force
Restart
Disable SMB v1 Client
sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi
sc.exe config mrxsmb10 start= disabled
Disable SMB v1 Server
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB1 -Type DWORD -Value 0 –Force
Restart
Detect SMB v2 Client status
sc.exe qc lanmanworkstation
Detect SMB v2 Server status
Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters | ForEach-Object {Get-ItemProperty $_.pspath}
You can also check you have smbv1 disabled with
Get-SmbServerConfiguration | Select EnableSMB1Protocol, EnableSMB2Protocol
THe official command lines by microsoft are those
Get-SmbServerConfiguration | Select EnableSMB1Protocol, EnableSMB2Protocol
Get-WindowsOptionalFeature –Online –FeatureName SMB1Protocol
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
Get-SmbServerConfiguration | Select EnableSMB2Protocol
Set-SmbServerConfiguration –EnableSMB2Protocol $false
Set-SmbServerConfiguration –EnableSMB2Protocol $true
Last edited by lqlaow; 19 Jun 2020 at 00:21.