How to Check and Disable SMBv1 on Windows

Why SMBv1 should be off

• It has been replaced. SMBv2 arrived with Windows Vista and Windows Server 2008, and SMBv3 with Windows 8 and Windows Server 2012.
• It has known, exploited flaws. Microsoft bulletin MS17-010 (March 2017) fixed several SMBv1 server flaws that let an unauthenticated attacker run code with one crafted packet. One of them, CVE-2017-0144, scores 8.8 on CVSS 3.1 and has been in the CISA Known Exploited Vulnerabilities catalog since 10 February 2022.
• It still turns up. Microsoft no longer installs SMBv1 by default on Windows 11 or Windows Server 2019 and later; Windows 10 Home and Pro are the exception. It also survives on older servers, upgraded machines, and wherever someone switched it back on for an old scanner or NAS.

Step 1: Check whether SMBv1 is on

The quickest check needs no admin rights. True means other machines can connect to this one over SMBv1.

Get-SmbServerConfiguration | Format-List EnableSMB1Protocol

For the full picture, run these from an elevated PowerShell window:

Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
sc.exe qc lanmanworkstation

Step 2: Find out what still uses it

Switching SMBv1 off can break a device that speaks nothing newer. Before you change a file server, turn on SMBv1 auditing for a week:

Set-SmbServerConfiguration -AuditSmb1Access $true

Each SMBv1 connection attempt then logs event ID 3000 in the Microsoft-Windows-SMBServer/Audit log. To list them:

Get-WinEvent -LogName "Microsoft-Windows-SMBServer/Audit" | Where-Object Id -eq 3000

The usual culprits are scan-to-folder on older printers and copiers, older NAS boxes, and legacy line-of-business software. Check the vendor for a firmware update first; Microsoft keeps a list of products that needed SMBv1 at aka.ms/stillneedssmb1.

Step 3: Turn it off on one machine

On Windows 8.1, 10 and 11, and Windows Server 2012 R2 and later, remove the component. The machine needs a restart afterwards.

Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

If you cannot restart yet, close the server side straight away. This takes effect without a restart, but it leaves the client side and the component in place:

Set-SmbServerConfiguration -EnableSMB1Protocol $false

Prefer clicking? Open Control Panel, then Programs and Features, then Turn Windows features on or off. Clear SMB 1.0/CIFS File Sharing Support, then restart.

Step 4: Turn it off across the domain with Group Policy

In Group Policy Management, edit a GPO linked to the machines you want, then go to Computer Configuration, Preferences, Windows Settings, Registry, and add three registry items under HKEY_LOCAL_MACHINE:

Run gpupdate /force on a test machine, check that the three values landed, then restart it. Roll out to a small group before the whole domain.

Step 5: Confirm it stays off

Re-run the Step 1 commands after the restart. Then keep checking: SMBv1 tends to come back when someone re-ticks the feature to get an old scanner working, or a machine is rebuilt from an old image. A one-off fix does not tell you about the laptop that changes next month.

Two things not to do

• Do not disable SMBv2 or SMBv3. Microsoft recommends keeping both on. Turning them off removes encryption, signing improvements and modern performance features.
• Do not switch off SMB signing to fix connection errors. Windows 11 24H2 and Windows Server 2025 require SMB signing by default, which can break connections to old NAS boxes. Update or replace the device instead.

How Sentrivox checks SMBv1

The Sentrivox agent reads the SMBv1 server setting on every Windows endpoint each time it scans, and marks any machine that still accepts SMBv1 as a Critical finding. You see every affected device on one screen instead of running Step 1 machine by machine. The check covers the server side; use the sc.exe command above for the client side.