Install smb 1.0/cifs file sharing support windows 7

#1

Wysocki

• Members
• 12 posts
• OFFLINE
 

• Local time:09:56 PM

Posted 11 April 2020 - 09:17 PM

I have one Windows 7/64 machine that I have SMB1 enabled on so that it can be accessed by my old Xerox scanner [no lectures please]. The registry has HKLM\system\currentcontrolset\services\lanmanserver\parameters\smb1 set to "1". Occasionally, SMB1 stops working and the scans fail. I have run NetScanTools SMB Scanner to check it and SMB1 suddenly is gone. Rebooting the computer puts it back up and running again though.

Why would SMB1 suddenly be made unavailable on that computer and how can I fix this?

BC AdBot [Login to Remove]

• BleepingComputer.com
• Register to remove ads

#2

sflatechguy

sflatechguy

• BC Advisor
• 2,719 posts
• OFFLINE
 

• Gender:Male
• Local time:12:56 AM

Posted 12 April 2020 - 09:14 AM

#3

Wysocki

Wysocki

• Topic Starter


• Members
• 12 posts
• OFFLINE
 

• Local time:09:56 PM

Posted 12 April 2020 - 01:43 PM

Thanks for the tip. I added the registry dword HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\SessTimeout with a value of 300 [decimal]. Not sure that it will have any effect since the link you pointed to says the change was made on the workstations, not the server. But in my case the workstation is a Xerox scanner. Wouldn't "LanmanWorkstation\Parameters" apply to the client, not the server? Plus, when I run the SMB scanner from another workstation, it reports that the server does not support SMB1 [SMB2 shows active] so it appears to be something that changes within the server that drops only SMB1. May take a few days to see if this has any effect, but I'll be reporting back.

Edited by Wysocki, 12 April 2020 - 01:46 PM.

#4

cknoettg

cknoettg

• BC Advisor
• 1,897 posts
• OFFLINE
 

• Gender:Male
• Location:Delray Beach, FL
• Local time:12:56 AM

Posted 12 April 2020 - 07:34 PM

If the issue persists, just so I don't forget later:

SMB1 is being aggressively and actively deprecated in recent months, so it doesn't surprise me that it has suddenly become an issue.

Do you have any details on this server that it is connecting to? Is it in an office setting?

What is the model # of the scanner?

Microsoft MCE, CASP+, Linux+, Server+, Cloud+, Certified Forensic Computer Examiner

#5

Wysocki

Wysocki

• Topic Starter


• Members
• 12 posts
• OFFLINE
 

• Local time:09:56 PM

Posted 12 April 2020 - 09:32 PM

It's a Xerox 4150 copier/scanner from the 1990's. Works great except that it only uses SMB1 for communication to a Windows network. The "server" is a peer to peer Windows 7/64 NUC with a shared D:\scans folder. It works for several days sometimes, then all of a sudden it fails. I run the SMB scanner utility from another computer which examines the network and shows the various levels of SMB support on each computer. Normally it shows them all without smb1 support except for the NUC computer [server]. But when scanning fails, I run the utility and it shows all computers have no smb1 support. Then I reboot the NUC and smb1 shows up as available.

#6

cknoettg

cknoettg

• BC Advisor
• 1,897 posts
• OFFLINE
 

• Gender:Male
• Location:Delray Beach, FL
• Local time:12:56 AM

Posted 13 April 2020 - 12:28 AM

As long as the utility still picks up the NUC when this happens, and you can ping the NUC when this happens, then it is not a case of losing network connectivity to the NUC.

So, it does indeed sound like SMB1 is corrupt on the server side. If we reinstall SMB1, then we can see if it stabilizes again.

I dont have a Windows 7 machine anymore, but if you pull up Turn Windows Features On and Off in the NUC, does it give you the option to de-select SMB1? If so, de-select it and restart the NUC after about 15 minutes. When it re-boots, re-select SMB1 and see if it stabilizes.

If not, something to consider: Nvidia released a firmware update on their NUCs that disabled SMB1. If a firmware update was applied, it could be overriding Windows settings.

I will have to await another commentor who knows if post-mortem Windows 7 Updates also included a disable SMB1 patch. Beacuse your problem is sporadic, though, I am cautiously optimistic that disabling and re-enabling the feature will work.

Microsoft MCE, CASP+, Linux+, Server+, Cloud+, Certified Forensic Computer Examiner

#7

sflatechguy

sflatechguy

• BC Advisor
• 2,719 posts
• OFFLINE
 

• Gender:Male
• Local time:12:56 AM

Posted 13 April 2020 - 11:25 AM

On Windows 7, the registry key is used to enable or disable SMB v1. I've not seen any documentation that Windows Update has disabled this; in fact, the documentation still shows how to enable it in the registry.

//docs.microsoft.com/en-au/windows-server/storage/file-server/troubleshoot/detect-enable-and-disable-smbv1-v2-v3#for-windows-7-windows-server-2008-r2-windows-vista-and-windows-server-2008

Not sure what would disable SMB v1 on "server". As @cknoettg pointed out, v1 is pretty much universally deprecated. Is it possible a firewall or AV program is blocking it? I've seen that happen with older versions of SMB.

#8

Wysocki

Wysocki

• Topic Starter


• Members
• 12 posts
• OFFLINE
 

• Local time:09:56 PM

Posted 13 April 2020 - 02:28 PM

Yes, even when SMB1 is down the NUC is still available for ping, vnc, file sharing, etc. Just no smb1. Windows 7 does not have the Windows Features for smb available. It is enabled it in the registry ...LanmanServer\Properties\SMB1 set to 1. I checked the Intel NUC site for info on smb1 with no luck. I'm running Malwarebytes and Windows Defender on it and the only reference I found was in Malwarebytes Release Notes: "Update Default Services Issue Scanner to prevent checking of the Computer Browser Service [browser] on Windows 8.1 or 10 systems that have disabled the SMB 1.0/ CIFS File Sharing Support feature/component of Windows.". But no reference to Win7.

Not sure what steps I could take when it fails other than reboot. Would there be any indicator in the Event Viewer? The NetScanTools SMB Scanner that I'm using is on a free trial for a few more days but it costs $250! Kind of pricey. Haven't found any other tools that could signal when the smb1 goes down, other than when my scans fail!

#9

cknoettg

cknoettg

• BC Advisor
• 1,897 posts
• OFFLINE
 

• Gender:Male
• Location:Delray Beach, FL
• Local time:12:56 AM

Posted 13 April 2020 - 03:36 PM

Since the Turn Windows Feature On/Off isn't an option, and the reg fix may only enable or disable it, we may need to use Powershell as admin to uninstall, then reinstall SMB1.

The general format is going to be:

Uninstall-WindowsFeature-Name FS-SMB1 -Remove

After it is uninstalled, then run:

Get-WindowsFeatureFS-SMB1

Enable-WindowsOptionalFeature -Online -FeatureName smb1protocol

Since I currently lack a Windows 7 system to test with, I will need assistance from the others to confirm

if we should run this from C:\Windows\System32, or some other location.

Microsoft MCE, CASP+, Linux+, Server+, Cloud+, Certified Forensic Computer Examiner

#10

sflatechguy

sflatechguy

• BC Advisor
• 2,719 posts
• OFFLINE
 

• Gender:Male
• Local time:12:56 AM

Posted 13 April 2020 - 05:15 PM

Check the documentation link I posted earlier. PowerShell works on Windows 8 and up. On Windows 7, the only way to enable or disable it is with the registry key.

#11

Wysocki

Wysocki

• Topic Starter


• Members
• 12 posts
• OFFLINE
 

• Local time:09:56 PM

Posted 26 April 2020 - 02:00 PM

Well, the problem continues on the Win7 machine with SMB1 going down. My free trial of NetScanTools is over [$249] so the only way I have now to find out it's down is when my scanner fails to save to it. The scanner showed that smb2 was still available and my general networking to that machine still works, just no smb1.

There HAS to be some small tool that I could use to verify that smb1 is still running on that machine, not just that it is ENABLED in the registry. Is there a way I could force using smb1 to network from another computer? Any network savvy coders out there?

#12

sflatechguy

sflatechguy

• BC Advisor
• 2,719 posts
• OFFLINE
 

• Gender:Male
• Local time:12:56 AM

Posted 27 April 2020 - 08:48 AM

On Windows 7, check to see if the MRxSMB10.sys process is running. This is the system driver that runs SMB v1. It should be viewable in the services.msc console or under Processes in Task Manager.

#13

Wysocki

Wysocki

• Topic Starter


• Members
• 12 posts
• OFFLINE
 

• Local time:09:56 PM

Posted 27 April 2020 - 01:47 PM

Currently, the machine is accepting SMB1 scans and NetScanTools shows it as active. However, I do not see any process or service in task manager [or services.msc] referring to mrxsmb10.sys. There are a lot of folders similar to C:\Windows\winsxs\amd64_microsoft-windows-smb10-minirdr_... that have a copy of mrxsmb10.sys in them, but it's not in the processes or services.  Should it be resident there all the time or is it only loaded when an SMB1 link is attempted?

Here's a pic of the smb scanner output [got my trial extended]. TERRY is Win7 with SMB1 disabled, SUE is Win10, and NUC is the problem Win7 machine with SMB1 enabled, but it's the one that goes down for some reason.

Edited by Wysocki, 27 April 2020 - 01:52 PM.

How do I enable SMB v1 in Windows 7?

Does Windows 7 support SMB?

What version of SMB does Windows 7 use?

What is SMB 1.0 CIFS file sharing?