ARCHIVED: About the SMBv1 retirement

• Overview
• Security concerns
• Recommendations

Overview

On April 7, 2019, Campus Communications Infrastructure (CCI) disabled SMBv1 on the Active Directory Domain controllers.

Server Message Block (SMB) is an application layer network protocol commonly used in Microsoft Windows to provide shared access to files and printers. SMBv1 is the original protocol developed in the 1980s, making it more than 30 years old. More secure and efficient versions of SMB are available today.

Security concerns

The SMBv1 protocol is not safe to use. By using this old protocol, you lose protections such as pre-authentication integrity, secure dialect negotiation, encryption, disabling insecure guest logins, and improved message signing. Microsoft has advised customers to stop using SMBv1 because it is extremely vulnerable and full of known exploits. WannaCry, a well-known ransomware attack, exploited vulnerabilities in the SMBv1 protocol to infect other systems. Because of the security risks, support for SMBv1 has been disabled.

Recommendations

SMBv1 should be disabled on all systems that do not have a business justification to warrant continued use.

For instructions, see:

• How to detect, enable and disable SMBv1, SMBv2, and SMBv3 in Windows
• How to configure Samba to use SMBv2 and disable SMBv1 on Linux or Unix