What is the impact of disabling SMB1?

MrBrian

AskWoody_MVP

June 30, 2017 at 6:33 pm #122763

• anonymous

  Guest

  June 30, 2017 at 7:15 pm #122772

  The guide for Windows 7 is pretty sloppy really… It is certainly not adressed for common users…

• ch200

  AskWoody_MVP

  July 1, 2017 at 6:46 am #122870

  The registry keys work in all operating systems, from Windows 7 to Windows 10/2016.

  1 user thanked author for this post.

• fp

  AskWoody Lounger

  July 3, 2017 at 12:36 pm #123078

  All you gotta do in Win10 is to go into Control Panel and turn it off as a Windows feature.

MrBrian

AskWoody_MVP

June 30, 2017 at 6:35 pm #122765

• ch200

  AskWoody_MVP

  July 1, 2017 at 6:52 am #122871

  I will have to say again that referring regular home users to Technet articles only confuses them.
  Technet and MSDN are targeting professionals and most information on those sites apply to the Enterprise versions of the Windows products. Sometimes it applies to the Pro versions.
  Regular non-power users should ignore most of the information on Technet and MSDN as it is presented on those sites.
  Those using Home Editions are in particular advised that the information on those sites does not apply to them.

  7 users thanked author for this post.

• • fp

    AskWoody Lounger

    July 3, 2017 at 12:40 pm #123079

    Generally true, but this is also a matter of degree — some of the items there are accessible to some of the users. So what I do is check them out and if I don’t understand them I ignore them. Once in a while they are useful.

    The advantage is that it’s more likely to find knowledgeable advice there, while in the non-tech MS forums you get useless responses, with too many of them being “reset” the system or ‘run Scannow”.

anonymous

Guest

June 30, 2017 at 7:29 pm #122777

is it the same if i disable lanmanworkstation service ?

• MrBrian

  AskWoody_MVP

  June 30, 2017 at 9:12 pm #122796

• • ch200

    AskWoody_MVP

    July 1, 2017 at 2:59 pm #122894

    I might not understand this issue completely, but I have always thought that disabling SMB1 is recommended for the Server service only and not for the Workstation service.

  • • MrBrian

      AskWoody_MVP

      July 1, 2017 at 4:21 pm #122904

      Both are covered in KB2696547.

PatC

AskWoody Lounger

June 30, 2017 at 8:30 pm #122792

I disabled SMBv1 on Windows 10 Pro 1607 per instructions and after a restart it could no longer see other computers on my LAN, a mix of Windows 7, Mac, Linux. Re-enabling it restored normality. Elderly hardware/router?

1 user thanked author for this post.

• ch200

  AskWoody_MVP

  July 1, 2017 at 2:59 am #122856

  You have just encountered something that most of those who disable SMB1 will encounter.
  Too much amateurish FUD is posted everywhere on the internet and a lot of people just feel like jumping on the fake news wagon.
  There is no guarantee that SMB2 or SMB3 are safe as they communicate via the same port(s) like SMB1, i.e. TCP 445 and potentially TCP 139.
  The fact that a particular attack use a certain component today does not mean anything tomorrow.
  A very smart person says all the time “future does not equal the past”, but very few people really listen or understand this correctly.
  The only correct approach for the time being to be as safe as possible is to patch and to use common sense.
  The other useful approach to be considered is to outsource the management to the cloud providers and be only a user, not an administrator of a system which has become too complex. Apple seems to have found the right balance with their iOS for most regular users.

  3 users thanked author for this post.

• • PatC

    AskWoody Lounger

    July 1, 2017 at 6:03 am #122866

    Thank you so much. I keep my computers patched, do daily data backups and make regular disk images. I rarely respond to panicky internet stuff, but on this occasion…  Are you saying that SMBv1 is not as deprecated as is being widely posted? Why else would disabling it prevent access to LAN computers?
    I’m afraid I don’t agree about cloud solutions. I prefer to keep my data/backups firmly within my own control. But that’s just a difference of opinion, which I’m sure you’ll allow, not relevant to the SMBv1 issue.

    1 user thanked author for this post.

  • • ch200

      AskWoody_MVP

      July 1, 2017 at 6:38 am #122868

      As you have noticed from your own experience which is not unique in this matter, SMB1 is not so widely deprecated.
      A lot of Linux/Samba based devices use SMB1 and this explains to some extent Microsoft’s insistence on disabling SMB1.
      If you look at the title of this thread, Woody says:
      “Turn off SMBv1 on Windows, but be aware of the consequences” and the last part says it all.

      The Cloud based solutions are intended to take much of the administration of the device from the user to someone specialised who does this everyday as a full-time job. There is no obligation at all to go that path if you don’t need it or don’t feel comfortable with it, it is only an alternative which I mentioned.

    • • Ascaris

        AskWoody MVP

        July 1, 2017 at 7:12 pm #122922

        A lot of Linux/Samba based devices use SMB1 and this explains to some extent Microsoft’s insistence on disabling SMB1.

        If you’re one of the people who uses network shares to perform backups, this may be an important point if you ever need to restore data.  Many of the backup programs use Linux-based rescue media, and having it not see the share upon which your backup set is written can be a huge frustration, particularly if some time has passed and it doesn’t occur to you that perhaps disabling SMB1 on the device acting as the server was the problem.  An advanced user will probably try using UNC paths immediately (which should work, according to what I have read), but the beginner will probably just be frustrated and annoyed.

        In other words, be sure to test your rescue media as well as the rest of the stuff if you’ve disabled SMB1, and if it doesn’t work, at least be aware of the issue so you can re-enable SMB1 on the device acting as the backup server if you ever need to restore, or work out some other plan in case you need the backup data.

        Dell XPS 13/9310, i5-1135G7/16GB, OpenSUSE Tumbleweed
        XPG Xenia 14, i7-1165G7/32GB, OpenSUSE Tumbleweed
        XPG Xenia 15, i7-9750H/16GB & GTX1660ti, OpenSUSE Tumbleweed

• Ascaris

  AskWoody MVP

  July 1, 2017 at 8:13 am #122875

  I had the same results trying this out.  I tend to agree with you on this (this particular exploit has been patched, and unknown exploits are unknown– they can just as easily be in SMB3 for all we know… such is the nature of being unknown).

  The “owner” of SMB at Microsoft, Ned Pyle, is nearly screaming from the rooftop to disable SMB1  (note that this Technet post was from 2016, long before this recent string of attacks based on SMB1 took place).  He says the protocol “needs to hit the landfill” and that if you need [the latest security patch for SMB1 at the time], you have a much bigger problem: You’re still using SMB1.

  I looked at his list of reasons SMB1 is insecure, and none of them really concern me with my small network.  Enterprise networks, certainly, but mine?  None of the new features would change anything.  I don’t have an AD server, and I am not concerned about attacks from within the perimeter (my entire network is visible from where I sit.  If someone messes with it, he’s in my house; I have more to worry about than my network shares).

  More notable than that, though, is the observation that the EternalBlue vulnerability that allowed WannaCrypt to do its thing had nothing to do with any of the reasons Mr. Pyle despises SMB1.  It was a flaw in the implementation, not a function of the obsolescence or lack of modern security features of SMB1.  If that were not so, it would not have been possible to patch SMB1 on every OS from XP on up, but patched it was.

  In other words, yes… SMB1 lacks a lot of security features that later versions have.  It lacked those features a year, two years, ten years ago too, and it’s no less safe now because of that than it was back then.  None of those security features would have mitigated the EternalBlue exploit, though, since the more advanced security features of later SMB versions are about securing network shares against unauthorized access from within the LAN, and that was not the attack vector for WannaCrypt or NotPetya.

  The exploit that made SMB1 vulnerable was a bug that allowed an attacker from the internet to send a specially crafted packet to a vulnerable PC, which would then run arbitrary code (in other words, whatever the attacker wanted it to run), which in this case was the WannaCrypt malware.  Once installed on a person’s PC, in addition to encrypting their data, WannaCrypt would then scan for more vulnerable PCs out across the internet and on the LAN, and if it found them, to attack them the same way that PC itself was attacked.

  I know none of this is news to you, CH100, but maybe others can benefit from it (assuming I got it right, of course).

  Dell XPS 13/9310, i5-1135G7/16GB, OpenSUSE Tumbleweed
  XPG Xenia 14, i7-1165G7/32GB, OpenSUSE Tumbleweed
  XPG Xenia 15, i7-9750H/16GB & GTX1660ti, OpenSUSE Tumbleweed

  6 users thanked author for this post.

• • ch200

    AskWoody_MVP

    July 1, 2017 at 3:11 pm #122895

    I looked at his list of reasons SMB1 is insecure, and none of them really concern me with my small network.  Enterprise networks, certainly, but mine?  None of the new features would change anything.  I don’t have an AD server, and I am not concerned about attacks from within the perimeter (my entire network is visible from where I sit.  If someone messes with it, he’s in my house; I have more to worry about than my network shares).

    You have the facts right here, but unfortunately the Enterprise users are those who are the least likely to be able to shut down SMB1 after 30 years of it being in wide use and a lot of legacy code using it. NetBIOS is still enabled in most places, knowingly or in many cases not knowingly as many of the current “experts” have no understanding of NetBIOS or WINS. NetBIOS is still enabled in automatic mode out of the box, although for most purposes it can be disabled safely. It offers the convenience of a basic name resolution when DNS is not working or just before having DNS configured in a reliable mode in large environments like AD Forest Trusts. Convenience does not equal safe computing, but it is what it is and people use it all the time. SMB1 is somehow a much less worry than NetBIOS, although they come from the same time and family of technologies.
    Microsoft should be the first player to have SMB1 not installed out of the box, but imagine the consequences, until people actually realise how to “fix” their issues and re-install SMB1.

    1 user thanked author for this post.

  • Noel Carboni

    AskWoody_MVP

    July 2, 2017 at 5:09 am #122961

    I looked at his list of reasons SMB1 is insecure, and none of them really concern me with my small network. Enterprise networks, certainly, but mine? None of the new features would change anything. I don’t have an AD server, and I am not concerned about attacks from within the perimeter (my entire network is visible from where I sit. If someone messes with it, he’s in my house; I have more to worry about than my network shares).

    Thing is, it’s about risk.

    You may trust your systems inside your perimeter – I trust mine too – but I can guarantee you the risk is not ZERO.

    In my case, all my communications are between Windows systems at Win Vista or newer levels (the Vista system is just a compatibility test platform; the critical systems are Win 7 or newer), so I was able to do without SMB1 entirely without loss of any needed functionality.

    So… No current downsides. I may re-evaluate that decision if I should take on another device and find that it does not handle SMB2/3. On the other hand, such lack of support will certainly flavor my choice of such device.

    Upsides?

    Simpler operation – and simpler is virtually always better with Windows and computers. They run more reliably, more efficiently.

    Lower risk – like you, I trust my internal systems because I apply equal protections to all. But the risk is still not zero, and an extra layer of protection with little downside is always welcome.

    What if… For example what if a visitor brings a device into my LAN that’s infected, and looks for vulnerabilities. Yes, I have a subdivision in my LAN between truly trusted and untrusted systems, but it’s necessarily not as strong as the division between inside and outside the LAN.

    Or what if there are still vulnerabilities in my security perimeter and a trusted system should become infected or corrupted. I’m under no misconception that that cannot still happen.

    We believe our trusted systems are worthy of our trust. Is that trust absolute? Of course not. NOTHING is absolute.

    Risk comes from the difference between what you believe and reality. And there is always a difference. We are human, and thus are incapable of fully understanding reality. Or if we do understand something, we might forget. Or we get stressed and let our guard down. Or we just act stupid. Or we get old. Or a determined adversary finds a way around our defenses. God help us if several of these things happen at once.

    If you’ve weighed the downsides of disabling SMB1 against the benefits and find that you’d rather retain SMB1 because it gives you benefit, nothing says you HAVE to disable it. After all, though Microsoft themselves quite clearly feel SMB1 should go around the bowl and down the hole, they enable it by default in every Windows system out of the box. Compatibility still is apparently important to them.

    Yet we know, we KNOW every Windows setting isn’t always the best for us and our particular needs out of the box. Now there are rumblings that Microsoft is going to change the defaults soon. That says something too.

    Every high tech decision is necessarily about weighing risk against benefits. Not every answer is going to be easy. At the end of the day we live with the consequences of the decisions.

    -Noel

    8 users thanked author for this post.

  • • AlexEiffel

      AskWoody_MVP

      July 3, 2017 at 1:37 pm #123088

      The sad thing is often Microsoft has to break things so that irresponsible companies fix their software and make them acceptable for the new context, a bit like what the UAC did for dumb software who required administrator’s right for no reason and wrote in all kind of bad places before the Vista era.

    • Ascaris

      AskWoody MVP

      July 8, 2017 at 4:17 am #123812

      You may trust your systems inside your perimeter – I trust mine too – but I can guarantee you the risk is not ZERO.

      No, but the benefit of using SMB2+ is zero, in my case, as none of the SMB2+ enhanced security features even come into play with guest-level permissions.

      In my case, all my communications are between Windows systems at Win Vista or newer levels (the Vista system is just a compatibility test platform; the critical systems are Win 7 or newer), so I was able to do without SMB1 entirely without loss of any needed functionality.

      Even with everything in the network being Win 7 or 8.1, I still saw what CH100 mentioned, which is inability to browse shares with SMB1 disabled.  You’ve mentioned that you don’t care about that as you remember the share names, and so can I, but I do also like being able to use the GUI to browse them without having to type in the share names or IP addresses.  It’s far from the “disable SMB1, you won’t even notice the difference” kind of way that Ned Pyle seems to suggest it will be.  If there is a way to get File Explorer to start allowing network browsing with SMB1 nixed, I haven’t found anything yet that describes how to do it, nor any mention of it from people like Mr. Pyle except to mention that only “decrepit” network management tools that insist on using Computer Browser will not work with SMB2+ only.

      Dell XPS 13/9310, i5-1135G7/16GB, OpenSUSE Tumbleweed
      XPG Xenia 14, i7-1165G7/32GB, OpenSUSE Tumbleweed
      XPG Xenia 15, i7-9750H/16GB & GTX1660ti, OpenSUSE Tumbleweed

fp

AskWoody Lounger

July 3, 2017 at 12:48 pm #123082

Which is why I pay little attention to sw vendors who keep pushing updates and upgrades as a way to prevent attacks.

The reality is that hacking is way ahead of vendors and those upgrades/updates are locking the barn after the horses got out. It is true that systems should be patched to prevent later attacks of already detected hacks, but it’s much more marketing than substance.

MS does this a lot to push Win10 and I have seen no convincing evidence.

anonymous

Guest

July 1, 2017 at 10:31 am #122878

PatC, please see post number 122876 below from MrBrian. Basically, in your situation you might want to avoid this fall’s upcoming Win10 update because it could very well put you back into the situation you just found yourself in, thanks to having machines with different OS’s networked.

• ch200

  AskWoody_MVP

  July 1, 2017 at 3:17 pm #122897

  This post is misleading. The reasons invoked are not serious enough to avoid modernising the technologies in use and keep up with what is on offer.

• • anonymous

    Guest

    July 1, 2017 at 8:48 pm #122914

    For many users such as PatC, losing all network connectivity and having to figure out how to use protocol to regain network connectivity is cause enough to not install the fall update for Win10.

    PatC has stated “I disabled SMBv1 on Windows 10 Pro 1607 per instructions and after a restart it could no longer see other computers on my LAN…” and the fact that “Windows 10 RS3 (Fall Creators Update) and Windows Server 2016 RS3 have SMB1 uninstalled by default under most circumstances” amounts to PatC possibly not having any network connectivity after installing the fall update in September. Granted, that system may not fall under Microsoft’s definition of “most circumstances” and therefore PatC might not be affected by the upcoming lack of SMB1 for Win10.

    The decision to update or not is an individual one based on a variety of factors, and possible lack of network connectivity should certainly be one of the primary factors, along with security of one’s system(s).

    This is a decision where PatC (and anyone else in this identical situation) needs to be fully informed of the very distinct possibility that they may lose network connectivity (and possibly suffer a subsequent loss of productivity) after installing an update to help keep their computer more secure.

  • • Ascaris

      AskWoody MVP

      July 2, 2017 at 3:43 am #122958

      So far, the plan is to have SMB1 not installed by default (as with clean installs of that version of Windows), but on machines that already have it installed, such as those upgraded from the previous build of Windows 10, it won’t be uninstalled.

      Still, with so many people reporting problems disabling SMB1, and with CH100 saying that it is “something that most of those who disable SMB1 will encounter,” I have to wonder… what is going on here with all of these people who should know about such things telling us that we should do it, won’t be a problem, you don’t need it?  They’re clearly not talking just to enterprise customers; a lot of them are giving specific how-tos that any IT pro wouldn’t need, so what’s the deal here?

      Since there is no WINS server or AD controller or anything else to dynamically provide name service (as opposed to, say, a HOSTS file) on some networks (like small home networks), computer browser provides a means of selecting one client on the network to be the master browser, which will perform that function, without any action needed on the part of the user.  That is, it “just works,” as the Apple people like to say.

      That goes away, though, if you remove SMB1, so what is supposed to provide that functionality in its absence?   What is supposed to make browsing shares “just work” for Windows 10 PCs released with the Fall Update preinstalled, with no SMB1 on it?

      I feel like I am missing something important here, ’cause it doesn’t make sense at all the way it appears.  It’s like a representative from Ford or Toyota or whatever carmaker you want telling people to let all the air out of their tires, you don’t need it anymore, you won’t even notice the difference!  Then people try it, and shockingly, they DO notice the difference, massively.

      Dell XPS 13/9310, i5-1135G7/16GB, OpenSUSE Tumbleweed
      XPG Xenia 14, i7-1165G7/32GB, OpenSUSE Tumbleweed
      XPG Xenia 15, i7-9750H/16GB & GTX1660ti, OpenSUSE Tumbleweed

      2 users thanked author for this post.

    • ch200

      AskWoody_MVP

      July 2, 2017 at 4:41 am #122960

      Some people get carried on by passion and search for complexity where there should be none or very little of it.
      Disabling SMB1 is complicated for Windows 7 for non-technical users, while on later versions it can be uninstalled and reinstalled like any Windows component which I verified and can confirm that it is reliable. On Windows 7 the possibility of making errors and not recovering easily or not recovering at all without clean reinstallation is high and this is confirmed by some posts here who are asking for simple methods, which unfortunately do not exist for the simple reason that in 2009 when Windows 7 was released, Microsoft did not intend to disable SMB1. This is also true for Vista. Editing registry to modify service dependencies is not quite straight forward for everyone, even if the instructions are accurate. Like any registry modification, it should not be attempted, unless understanding entirely the procedure and its effects and how to rollback. Backup restoration is not rollback, it is only a last resort procedure which is rarely 100% trouble-free and which should only be attempted as result of despair, a bit like claiming insurance, even if the excess is quite high.
      I am not sure if there is a direct relationship between NetBIOS name resolution and Computer Browser service and any version of SMB, but it is possible, because they belong to the same generation of protocols, designed about 30 years ago and still in significant use today.
      I will end my participation in this thread here because all the available options have been presented here and @MrBrian produced valuable information for those inclined to follow this path of disabling SMB1. Only a word of warning that it is not for everyone to implement it correctly and roll-back if needed, at least on Windows 7.

      4 users thanked author for this post.

    • Ascaris

      AskWoody MVP

      July 8, 2017 at 4:36 am #123813

      Backup restoration is not rollback, it is only a last resort procedure which is rarely 100% trouble-free and which should only be attempted as result of despair, a bit like claiming insurance, even if the excess is quite high.

      If that’s true, I think it’s safe to say that you need another backup program!

      I restore from backups pretty frequently, even though the true “despair” moment is rare indeed.  Restoring from backup is not a last resort for me.  If a recent backup is available, it’s a first resort of sorts; it fixes the problem in minutes and restores to a previous point in time without a doubt.  The only downside is that I get a “Windows was not shut down properly” event in the event viewer and the reliability monitor after a restore operation (such is the norm using the shadow copy service).

      If I can’t rely on my backup program to deliver this kind of performance, it’s no good to me.  That’s partly why I stuck with Acronis True Image for so long after it became buggy in other ways… once it has completed writing a given backup image, I have never had it fail to turn that into a perfect copy of whatever it was supposed to be copying, and I have restored many, many times over the years.

      Dell XPS 13/9310, i5-1135G7/16GB, OpenSUSE Tumbleweed
      XPG Xenia 14, i7-1165G7/32GB, OpenSUSE Tumbleweed
      XPG Xenia 15, i7-9750H/16GB & GTX1660ti, OpenSUSE Tumbleweed

    • MrBrian

      AskWoody_MVP

      July 2, 2017 at 8:13 am #122969

      @Ascaris: You may find this comment from Ned Pyle interesting:

      “[Question] You have some decrepit management software that demands admins browse via the ‘network neighborhood’ master browser list.

      So, support for network neighborhood browsing is going away with the new versions of SMB v2>? How do applications or users file explore the network for shares that they can’t remember the path or they don’t have a mapped drive to it going forward?

      [Answer by Ned Pyle] It went away 10 years ago. The computer browser never had support for SMB2 or later; most apps and interfaces changed to things like UPnP, MDNS, Bonjour, etc. All your computers also blocked this by default at the firewall. If your users browse this way, you will have to turn SMB1 back on and let the browser come back, and accept all the security risks of anonymous device browsing and connections. As with everything I mentioned, you have the option to run legacy forever.

      Note: we have broken this browsing multiple times through bugs in W10, and hardly anyone complained. This particular aspect of network browsing is used by almost no software in years, because it doesn’t scale and users in all but the tiniest environments cannot browse due to network router and switch rules. Plus IT pros preferred to map them drives unless the users themselves were IT pros.”

      2 users thanked author for this post.

    • Ascaris

      AskWoody MVP

      July 4, 2017 at 12:49 am #123161

      Mrbrian,

      I did see that in the original blog post by Mr. Pyle. Regarding the citation:

      “You have some decrepit management software that demands admins browse via the ‘network neighborhood’ master browser list.”

      Decrepit network management software such as… Windows 8.1’s File Explorer?  That’s what I tried with SMB1 disabled, and it didn’t work.  I know he tossed out several things that supposedly would do the work of Computer Browser, like uPnP (and an Apple protocol?  How’d that get in the list?), but… well, why don’t they do it then?  If they were really ready to take on the role to the point that “you don’t need [Computer Browser],” what CH100 said (that seems to be true from what I have read and experienced) that most people will have the problem if SMB1 is disabled (that is, inability to browse) would not be the case.  We had something that worked (even if it was and is notoriously fussy), and now the things that are supposed to replace it don’t do it.

      UPnP seems like the most likely candidate here, as it is also an ad-hoc (not in the wireless sense), decentralized automatic configuration protocol, but in the short time I played with it, I could not get it to permit browsing.  If anyone has any info about this, I would be fascinated to see what it is… I have no concern for the insecurity of SMB1 as I’m not using any of the security features that SMB2/3 does better anyway, but I always like to learn something new.

      I’ve been working with the master browser list and the surrounding stuff since it was considered current, but I have habitually disabled uPnP and SSDP since the early XP days, when there was a lot of noise similar to this SMB1 issue about security problems.  As I’ve never relied on uPnP for anything (and the “hey router, hows about you open up that port for me” thing never seemed like a good idea), disabling it had no effect at all, so even if the security issue was overblown/fixed/whatever, it didn’t matter.

      Now, though, I turned it back on for testing this.  I set Sphinx firewall control to “allow all,” disabled Windows Firewall (not the service though), put SSDP and uPnP back on on all my computers, enabled “discovery” on all of them (it won’t remain enabled if you check the radio button with both of the services OFF) and… nothing worked to be able to browse.

      As Noel mentioned, I can access all my shares by typing the UNC pathnames in… even if the name resolution didn’t work and I didn’t want to use HOSTS, I have all my network devices on reserved local IPs, and I have the IPs memorized, so it’s quite easy to do.  My concern is for the novice who reads this “disable SMB1” advice and finds the shares gone, as far as he is concerned.

      Unless Microsoft has a solution that is as good as the old thing, they shouldn’t be telling people to go ahead and turn the old thing off (even though Ned Pyle’s post post was not directed at novices, it was completely predictable that it would find its way to them, as it has been posted as support for the people who ARE recommending SMB1 be disabled for everyone, and as a MS developer, he’s authoritative on the topic).   Or maybe they do have something as good as the old thing and I just don’t know what it is– quite possible, but this “can’t browse” thing is too common around the net for me to think that off the bat.

      When I have SMB1 off, the navigation panel entry in File Explorer has no reason to be.  It just dangles there, wistfully offering me the option to expand it to see what the shares are, and when I do, nothing shows up.  That does not suggest to me that this is intended, normal behavior for a networked PC.  There’s supposed to be something under the “Network” category header, but there isn’t, until I turn SMB1 back on.

      Dell XPS 13/9310, i5-1135G7/16GB, OpenSUSE Tumbleweed
      XPG Xenia 14, i7-1165G7/32GB, OpenSUSE Tumbleweed
      XPG Xenia 15, i7-9750H/16GB & GTX1660ti, OpenSUSE Tumbleweed

      2 users thanked author for this post.

    • Noel Carboni

      AskWoody_MVP

      July 2, 2017 at 10:17 am #122978

      When I want to connect to shares on another computer I just use the computer’s name and share name.

      Example: VM’s name is W10VM and the share is C, so to see what’s on C I type: \\W10VM\C

      I don’t need to “browse” what’s offered, I already know what’s there. I set it up.

      -Noel

      1 user thanked author for this post.

    • Noel Carboni

      AskWoody_MVP

      July 2, 2017 at 11:39 am #122982

      In thinking about it further, this DOES expose something mildly interesting, though…

      For years I avoided relying on the results of the “Bowser” service (note, Microsoft misspelled the name Browser eons ago and it stuck). I avoided it so thoroughly – simply because I dislike flaky things – that I completely stopped expecting it to be there – probably around the time of Windows XP or maybe even earlier.

      When I made my transition to eliminating SMB1 and Bowser, I saw the cessation of various “xxx elected master browser” messages in the log and the mysterious appearing and disappearing system names. I remember thinking at the time, “good riddance to flaky behavior”. It always seemed I had gone the proper way – assuming you know the names, Windows Networking works just fine without it.

      At this point I even hide the Network entry in Explorer’s navigation pane. That in itself has a small advantage in that it avoids a small but maddening navigation pane behavior in Explorer.

      With the additional time that’s passed it didn’t even occur to me in light of discussions here that others might miss the browsing facility.

      It serves to illustrate that Windows is so complex that no one person is likely to use it all, nor can one person’s experience unconditionally be applied as advice to another.

      -Noel

      2 users thanked author for this post.

• fp

  AskWoody Lounger

  July 3, 2017 at 12:50 pm #123084

  Oh, yeah, right. The history and evidence of Win10 and updates/upgrades is a clear one of “modernizing”.

  If this is what modernizing means, I want nothing to do with it.

  1 user thanked author for this post.

MrBrian

AskWoody_MVP

July 1, 2017 at 5:02 pm #122910

I am curious if you’d have the same problems if you disabled SMB1 using the script in post #122763. It does some things not done in KB2696547 that might make a positive difference.

• ch200

  AskWoody_MVP

  July 1, 2017 at 6:24 pm #122912

  As far as I can tell, that script only configures service dependencies, while otherwise still disables SMB1. This is the core issue, not the dependencies.

  And disabling the client SMB1 is definitely a mistake.
  Not every article/blog post has to be taken literally, even if it has great value in most of it. In this case, the author has an interest to completely remove SMB1 from the picture, while the user interest is elsewhere. The vulnerability is not in the client, but the server service. The client is useful for example if connecting to Samba versions supporting SMB1 and this is the case for many NAS devices. Also some print servers not running Windows, but an embedded (firmware) version.

• • MrBrian

    AskWoody_MVP

    July 1, 2017 at 8:14 pm #122926

  • • ch200

      AskWoody_MVP

      July 1, 2017 at 11:30 pm #122929

      Hmm, very interesting to know. Thank you @MrBrian
      So you actually tried to convince me that it is not a mistake to disable the SMB1 client in addition to the server service for SMB1 and now you succeeded. The fact that the vulnerability in KB2536276 has been patched 6 years ago is not relevant for our discussion, because what is relevant is the proof that the client can be breached as well. A new vulnerability can be discovered at any time.
      Regardless, I still find it as too much involvement for regular users to do this sort of tweaks, because it is very easy to get it wrong and who is available to support rolling back in case they get stuck?
      Perhaps a good option would be to wait until RS3 is released and when it becomes official, I would certainly not have any objection to use Windows 10 RS3 as intended, with SMB1 disabled if this is what Microsoft will support moving ahead.
      For other versions though, I cannot advise users which I cannot fully support to modify their systems for the reasons mentioned above.

      2 users thanked author for this post.

    • MrBrian

      AskWoody_MVP

      July 2, 2017 at 10:16 am #122977

• fp

  AskWoody Lounger

  July 3, 2017 at 12:55 pm #123086

  I just did and I see NO problems whatsoever.

  But I don’t have multiple systems on the network, only 2 Win10Pro identical machines and I don’t use any special hw beyond external hard drives and a printer.

Geo

AskWoody Plus

June 30, 2017 at 8:44 pm #122795

For Win 7 x64 apply security patch KB4012212

MrBrian

AskWoody_MVP

July 1, 2017 at 8:40 am #122876

From Stop using SMB1:

“Update June 30, 2017 – You have probably seen me announce this on twitter and in other public venues: Windows 10 RS3 (Fall Creators Update) and Windows Server 2016 RS3 have SMB1 uninstalled by default under most circumstances.”

2 users thanked author for this post.

• ch200

  AskWoody_MVP

  July 1, 2017 at 3:23 pm #122898

JohnW

AskWoody Plus

July 1, 2017 at 1:15 pm #122888

Letting all devices share data over my home LAN makes me nervous.

So I use two wifi SSIDs on my home network router.  I use a separate secured guest network for all of my mobile devices, including my Androids, and my Windows laptop.  I use wireless isolation on this hotspot, so that the devices can only see the internet, and not each other, or my desktops on the main network.

My stay at home devices are either hard wired ethernet to the router, or use the main wifi SSID.  I allow this network to be trusted, since the individual devices are reasonably secured, and never leave home.

I figure this is another layer of security against any creepy crawlies that might compromise my mobile devices while I am out and about.  That way any damage is confined to only one device.

2 users thanked author for this post.

Snowflake Theory

AskWoody Lounger

July 1, 2017 at 3:38 pm #122900

Why does Chicken Little come to mind so often these days?

BrianL

AskWoody Lounger

July 1, 2017 at 3:57 pm #122902

Can a 1,2,3 be found to disable or delete SMB1 on single home computers?

• PKCano

  Manager

  July 1, 2017 at 4:16 pm #122903

• Kirsty

  Manager

  July 1, 2017 at 4:28 pm #122905

  @BrianL
  Yes, disabling SMBv1 has been discussed at length over the last 2-3 months, as it relates to quite a few of the recent malware/cyber threat issues, which KB2696547 details in depth.
  A search on the site for that and SMB vulnerabilities gives several results 🙂

• • PKCano

    Manager

    July 1, 2017 at 4:31 pm #122906

MrBrian

AskWoody_MVP

July 1, 2017 at 4:54 pm #122908

Post #122763 has a script that is a superset of the instructions in KB2696547.

anonymous

Guest

July 1, 2017 at 10:14 pm #122921

Brian, which version of Windows?

For Win 7, you can either follow ch200’s advice above for creating the registry edit file, run it and reboot the computer or run a couple of commands at an elevated command prompt and reboot the computer. The commands to run (directly from Microsoft’s page about this) are:

To disable SMBv1 on the SMB client, run the following commands:

sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi
sc.exe config mrxsmb10 start= disabled

For Win 8.1 and Win10, it’s just a point and click operation within the Add/Remove Programs menu. Click on Windows Features and scroll down to the box that says “SMB 1.0/CIFS File Sharing Support” and clear the check box, then reboot the computer.

Most of the advice in this post is directly from the page referenced by PKCano in post #122903.

Edit ti remove HTML

• ch200

  AskWoody_MVP

  July 1, 2017 at 11:34 pm #122930

  The registry edit works on all versions of Windows starting with Vista. It applies to Windows Vista, 7, 8/8.1, 10 and server equivalent. This is the same which is implemented by running the PowerShell command documented by Microsoft.

• • anonymous

    Guest

    July 2, 2017 at 1:08 am #122939

    “The registry edit works on all versions of Windows starting with Vista. It applies to Windows Vista, 7, 8/8.1, 10 and server equivalent.”

    However, a great many users of Win 8.1 and Win 10 probably much prefer to use the GUI to do anything via point and click than to knowingly edit the registry by any means. That’s probably got a lot to do with why Microsoft made it so easy in Win 8.1 and Win 10…they figured users would want an easier way to get out of using SMB1 than having to get into the registry or use PowerShell.

    By the way, the GUI method is also available in the Server equivalents of Windows 8.1 and Windows 10, albeit it looks slightly different in Windows Server Manager.

  • • ch200

      AskWoody_MVP

      July 2, 2017 at 1:47 am #122942

MrBrian

AskWoody_MVP

July 2, 2017 at 7:46 am #122966

@anonymous: Also do the SMB Server part of KB2696547.

• anonymous

  Guest

  July 2, 2017 at 10:56 am #122975

  @MrBrian: Did so when I first got wind of the MS advice for just how to do it, before this thread was even started by @Woody. I didn’t even bother with trying to use GPEdit. Just used regedit, paying close attention to the exact key location and exact type of entry (DWORD, etc.) to add or which entry to edit and the data type (hex or decimal) to use when editing.

  To be sure I got everything (only 3 changes to actually perform for me), I reread through the bulletin a few times SLOWLY (see next paragraph). I am one of those who is comfortable making changes in the registry as long as I have EXPLICIT instructions on exactly what to edit as, like most folks, I don’t want to “brick” my computer by making inadvertent changes to the wrong key or inputting the wrong data type (decimal value instead of hex, for example).

  I have two machines networked with each other (no server involved) so I used the client instructions for each one at first, but rereading through it (the security bulletin from MS) and reading some of the comments on this thread, I made another change and added an entry under the LanmanServer/Parameters node to disable SMB1 on the server side as well.

  I have seen advice (I don’t believe it was on this forum) to add an entry under the LanmanWorkstation/Parameters node to disable SMB1 on the client side (very same entry placed under LanmanServer/Parameters node for server side), but I don’t believe that needs to be done…editing the entry a little further down the nodes titled “mrxsmb10” per MS’s instructions in KBKB2696547 should totally turn off all functionality of SMB1 on the client computer in the first place. So that LanmanWorkstation isn’t “broken” by turning off SMB1 in the registry, you also have to go into the LanmanWorkstation node and remove its dependency on SMB1 starting in the first place, as instructed by MS in KBKB2696547.

  By the way, I did finally try to see if I could use gpedit to make the changes listed in the KB bulletin but, although I have Win 7 pro on both machines, the needed headings in gpedit weren’t there, so that part of MS’s advice is only applicable to the server versions of Windows when dealing with making changes for (and propagating them to) their clients.

  1 user thanked author for this post.

ch200

AskWoody_MVP

July 1, 2017 at 6:40 pm #122916

@brianl

Copy the following in a text file named DisableSMB1.reg
Double-click on the file and if required, allow to run as administrator.
This works on all operating systems and it is all that you need to do.
Do not copy the stars 🙂

Note that I provide this for your convenience and I am against disabling SMB1 which does not provide any benefit. Patching correctly and in full provides all the benefits instead.

*************************************************************************************
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters]
“SMB1″=dword:00000000

*************************************************************************************

EDIT: This is a repost of a previous post which was not showing the full text due to limitations of the forum software

4 users thanked author for this post.

Kirsty

Manager

July 2, 2017 at 12:57 am #122938

Microsoft to Disable SMBv1 in Windows Starting This Fall
By Catalin Cimpanu | June 13, 2017

 
Starting this fall, with the public launch of the next major Windows 10 update — codenamed Redstone 3 — Microsoft plans to disable SMBv1 in most versions of the Windows operating systems.
…
In the past few months, SMBv1 has been in the limelight like never before. The Shadow Brokers leaked a batch of hacking tools that revolved around exploiting SMBv1 security flaws. If this wasn’t enough, someone used one of these exploits to help create a ransom-worm called WannaCry that wreaked havoc across the world.

Despite these high-profile incidents, the decision to disable SMBv1 was made long before that.

“It started 5 years ago,” Pyle said. “We made the decision public in 2014, without setting specific dates and OSes until later.”

That date is now the release of Windows 10 Redstone 3, also referenced as the Fall Creators Update, scheduled for launch in October/November 2017.

After that day, every new Windows 10 or Windows Server 2016 OS you install will not have some or all of SMBv1 turned on, which is the norm right now.

 
The article goes on to say that SMBv1 had been superceded by later versions and funtionality: “SMB1 brings no special value except ubiquity”
Read the full article on bleepingcomputer.com

1 user thanked author for this post.

MrBrian

AskWoody_MVP

July 2, 2017 at 8:04 am #122968

You can go even further and disable all SMB traffic (not just SMBv1 traffic) between computers on your local network. I have done this for years for Windows 7 as a security measure for protection against malware spreading between computers on the home network. See Turn Off Network Discovery, File/Printer Sharing and Public Folder Sharing In Windows 7 for details.

2 users thanked author for this post.

• anonymous

  Guest

  July 2, 2017 at 4:51 pm #122990

  Thanks. This seems like an easy straightforward way to turn off at least some aspects of SMB without much risk of something going wrong. For a newbie like me – who’s managed to get in fairly deep trouble before – that’s important.

  
  
  @ch200, I know you said you would not post to this thread anymore, but if you read this, I’m wondering if in your opinion doing what MrBrian suggests in the above post (#122968) is OK or whether you would recommend against it.

  I generally subscribe to the “do less is better” mentality, but I’m ignorant enough about this stuff to want to hear everybody’s viewpoints.

  Thanks again.

  DrB

• satrow

  AskWoody MVP

  July 2, 2017 at 5:29 pm #122993

  You can go even further and disable all SMB traffic (not just SMBv1 traffic) between computers on your local network. I have done this for years for Windows 7 as a security measure for protection against malware spreading between computers on the home network. See Turn Off Network Discovery, File/Printer Sharing and Public Folder Sharing In Windows 7 for details.

  For the last 10+ years I’ve also disabled the Workstation and Server Services for similar reasons.

  1 user thanked author for this post.

• • MrBrian

    AskWoody_MVP

    July 3, 2017 at 12:51 am #123012

    I wonder if doing this deactivates the functionalities described in KB2696547, such as symbolic links, which could cause problems?

MrBrian

AskWoody_MVP

July 3, 2017 at 12:42 am #123009

(I believe that this post is relevant only if you use Windows Firewall as your firewall.)

I just checked my Windows 7 settings. I use the Public network profile for my network connections. Also make sure the settings for the Public network profile are set to those at Turn Off Network Discovery, File/Printer Sharing and Public Folder Sharing In Windows 7.

I just (re)tested if this is effective using SuperScan 4.1 with these settings from another computer. Scanning ports 1-1023 for both UDP and TCP, the difference between the Public network profile (with default settings) and the Home network profile (with default settings) is that these ports are not open with the Public network profile: TCP 135, TCP 139, TCP 445, and UDP 137. None of the 5 ports listed at https://en.wikipedia.org/wiki/Server_Message_Block (TCP 137, TCP 139, TCP 445, UDP 137, UDP 138) were open with the Public network profile. I believe that using this method is sufficient to protect against malware on your local devices from using SMB exploits on your other local Windows computers.

In summary, if you use Windows Firewall on a given Windows computer, setting its network connections to use the Public network profile (with default settings) should protect the given Windows computer from other devices on your local network using SMB exploits against it.

3 users thanked author for this post.

• AlexEiffel

  AskWoody_MVP

  July 3, 2017 at 2:41 pm #123106

  I have also done this for years with success and no issues on independent computers, like laptops going on the road.

  So, for the average home user who don’t need to share files by accessing other PCs (including Linux or Macs) on the network and who doesn’t use NAS or other backup solutions that require those network protocols, I think it is indeed a good way to reduce risk without breaking functionality.

  ch200, I respectfully disagree with your position that things are safe enough because there is patching. I would accept maybe “you might experience less issues only relying on patching”. However, the real problem now is lists of vulnerabilities are probably sold to criminals and some states and will continue to be so in the foreseeable future so anything that can be attacked remotely without user intervention is an unnecessary risk, to me. Even behind a router with a patched computer, your teenager might get infected and then send the gift to you. If you take your laptop to public places, you are at risk too. Home users are not more safe than businesses and lots of those have had issues with that kind of problems, even with all their supposedly good security tools in place. I always have been against adding more protocols as it introduces another layer of potential security issues. Just looking at the current situation might not be an adequate assessment in the context we live now, as MrBrian showed you with the client vulnerabilities that you didn’t know about. Yes, I agree with you that for a lot of people, risk can be minimal in the current situation with the actual malware exploiting it, but it might not always be the case in the future and maybe for some it is better to reduce risks than to ensure maximum compatibility, depending on their level of comfort with both. This time, Microsoft had patched before the malware for some of it, but next time, it might not be the case and it might not be doable quickly too.

  I would suggest, but only to those comfortable with this (for example, you only have one computer and maybe a printer connected by USB), like MrBrian says, and it is easily reversible, to set your network to Public (I set it to always public using group policy and prevents from choosing anything else to users so it is always public wherever they connect). Please note that this disables basic file sharing among computers (indirectly). Then, I disable all those sharing protocols I don’t use on the network card by removing the check mark on them and only leave IPv4 and QoS. ch200 would say to leave IPv6 on the network card, fine, go ahead, do as he says, I used the registry to disable it and maybe it is not a good idea for the future, so you might prefer to leave it on. Take a note of everything so you can revert back to previous settings if something doesn’t work. Please note some protocols might be there that are not by Microsoft and might be needed for you, so the link MrBrian provided covers the Microsoft ones.

  The only thing, and here I join ch200 in his huge warnings, is you might forget about all this and later install a software that would require those network protocols and you might not know why it doesn’t work, and also the tech support person on the other side of the line might not think about it too or might not be knowledgeable enough to check that, so if you are not comfortable with that, maybe it is best to not touch anything. I think I had one person experience issues with AppleTV with such a configuration, but maybe it was for another reason like using AP Isolation on the router, I don’t remember.

  I am the kind of user who like to keep things simple, like Noel, because they work better that way, so I don’t integrate all kind of other devices together and when I do add devices, I keep them distinct from the other ones and exchange information through other means. Your situation might be different. But for a really standalone, simple computer with no special need, it might be fine to do all this.

  The good thing about Microsoft disabling SMB1 by default will be software vendors will have an incentive to change their products so they stop receiving calls from customers. Since it will only be on new installs, you retain compatibility for computers actually in use, but slowly gives an incentive to change. Customers will suffer though, not knowing what is going on when the software they just bought doesn’t work, but it seems that it is the only way to make companies change sometimes.

  I also often use AP Isolation on the router as it is something that can prevent your teenager computer from infecting yours by making sure each wireless device can’t communicate with each other. Please keep in mind many things might use sharing of information and you might not realize it (AP Isolation blocks all local traffic, not just file sharing). Suppose you have two kids on Ipad wanting to play Minecraft together in the same world locally. It works, but with AP Isolation, it doesn’t because they can’t talk to each other on the local network. You need to always be ready to think about these things if you experience issues, which might be too much of a burden to some. Your wifi printer won’t work with you Ipad in AP Isolation and not with your PC if it is not plugged into it using the USB port. If your router supports the guest network, you might prefer to keep your PC on a separate network and have the convenience of sharing for the mobile devices and the printer on the guest network. No black or white here.

  In conclusion, I can’t advise people to do things like this and ch200 is right in pointing there is a risk of issues even if I successfully did these things with many normal users without issues. I think though that exchanging information and sharing our experiences can help some do their own research and figure out what is appropriate for them, with their level of comfort and tolerance for risk, both the security and usability ones.

  4 users thanked author for this post.

• • JohnW

    AskWoody Plus

    July 3, 2017 at 3:38 pm #123111

    That’s a good perspective!  There truly is no one-size-fits all solution for safe networking for everybody.  And if somebody ever writes that app, they can probably afford to have an early retirement, LOL!

    But to your point about devices sharing information over your LAN, other than file sharing, I will add that taking a look with a network analysis tool like Wireshark will certainly open your eyes.

    Wireshark is not for the meek, though.  If you think looking at Windows Event Viewer and looking up error codes is daunting, wait till you wonder what all those packets are doing in your airspace, LOL!!!

    I like to isolate my Android devices in particular, however, because they are the devices I have the least control over.  And I am referring to the factory loads, as never bothered to try “rooting” them.  I don’t like being at the total mercy of unpatched Android flaws, fixes never pushed out by the manufacturer, plus all of the developer’s apps given who knows what permissions.

    I’ll be danged if those devices get a free ride on my network!!!  🙂

    1 user thanked author for this post.

  • • anonymous

      Guest

      July 3, 2017 at 11:29 pm #123150

      Maybe those with a Windows 7 computer on a network would be better just isolating it from the network? No other workarounds required, and wait for better times, use old fashioned usb file transfers?

      John, try Netguard (No Root) Firewall on your android devices, its great.

    • JohnW

      AskWoody Plus

      July 4, 2017 at 8:40 am #123195

      Perhaps I wasn’t clear.  My goal is not to protect my Androids, it is to protect my network from (potentially rogue) Androids.  So I treat them all as “untrusted”.

• Ascaris

  AskWoody MVP

  July 4, 2017 at 1:03 am #123163

  I would accept maybe “you might experience less issues only relying on patching”. However, the real problem now is lists of vulnerabilities are probably sold to criminals and some states and will continue to be so in the foreseeable future so anything that can be attacked remotely without user intervention is an unnecessary risk, to me.

  Those vulnerabilities could be in anything, though.  They could be in SMB2 or 3, or in any of the other of hundreds or thousands of components in a Windows installation.  Now that the reason we’re even talking about SMB1 so much lately (the EternalBlue exploit that enabled WannaCrypt and NotPetya) has been fixed, SMB1 is just like any other thing on Windows that can be disabled to reduce the attack surface a little bit, and if there really are no negative effects, go for it… but to put up with even a little bit of dysfunction because it might have an undiscovered security flaw in it doesn’t really make sense to me, because that is a concern with everything you connect to the internet anyway, whether Windows, iOS, MacOS, Linux, or Android, and it’s no more likely in SMB1 than in any other component.

  Dell XPS 13/9310, i5-1135G7/16GB, OpenSUSE Tumbleweed
  XPG Xenia 14, i7-1165G7/32GB, OpenSUSE Tumbleweed
  XPG Xenia 15, i7-9750H/16GB & GTX1660ti, OpenSUSE Tumbleweed

  2 users thanked author for this post.

• • AlexEiffel

    AskWoody_MVP

    July 4, 2017 at 9:08 am #123199

    Ok, but I am not sure there are that many Windows components just sitting there waiting to be infected. SMB is a protocol that can be triggered remotely just by someone sitting at a café activating the private network instead of the public network when asked because they think private is more private and they are sitting in a coffee, not knowing they just activated file sharing as if they were in their private home network. The problem is then that any computer can send crafted packets to the computer using SMB, which is not the case for many other components of Windows.

    Some components are clients, but they might often be clients of specific addresses or likely more safe addresses, certainly not clients of random computers scanning IPs randomly to send bad packets to those vulnerable.

    That is why I think some components reduce the attack surface more than others. You will not hear about a widespread sudden infection of millions of computers through Word looking up the online database for a picture to insert (not sure that still exists, I don’t use it).

    1 user thanked author for this post.

  • Ascaris

    AskWoody MVP

    July 8, 2017 at 5:06 am #123815

    SMB is a protocol that can be triggered remotely just by someone sitting at a café activating the private network instead of the public network when asked because they think private is more private and they are sitting in a coffee, not knowing they just activated file sharing as if they were in their private home network.

    I don’t have any shares on devices that are going to leave the house (ie laptops), mostly for that reason.  Even SMB 2 or 3 can be inadvertently activated on inappropriate networks this way, though.

    I think the wording was better when the network types were “Home,” “Work,” and “Public,” as in Windows 7.  That’s a lot clearer than “Private,” I think.  If it had to be two options, I would have preferred “Trusted” and “Untrusted.”

    I think the entire networking UI is a lot better in 7, but MS decided to “improve” it for 8, for some reason, and that was one of the changes.  They made it needlessly annoying and klunky to change a network from “Public” to “Private” or vice-versa… I had to look it up myself after migrating to Windows 8.1, and if it’s not intuitive enough for someone who has been using Windows networking for a while to find it, then it’s pretty well hidden.

    Of course, I guess it should have been obvious (facetiously): if you are looking at the “Network and Sharing Center” and you want to change the network type, instead of clicking the displayed network type as you used to be able to in 7, simply minimize the Network and Sharing window, open the Settings app, navigate to that version of the network settings, then switch the option for “allow file sharing on this network,” which actually has the effect of changing the network type (I would have thought it was changing the permissions for sharing on the currently selected network type, whatever that may be). What could be a simpler or clearer way to change from Public to Private or vice-versa?

    With Metro being forbidden on my PCs, though, I just use secpol.msc.  Fortunately, MS didn’t cripple the Control Panel nearly as much in Windows 8 as they have in 10… I’ve still been able to find non-Metro workarounds for everything thus far.

    Dell XPS 13/9310, i5-1135G7/16GB, OpenSUSE Tumbleweed
    XPG Xenia 14, i7-1165G7/32GB, OpenSUSE Tumbleweed
    XPG Xenia 15, i7-9750H/16GB & GTX1660ti, OpenSUSE Tumbleweed

MrBrian

AskWoody_MVP

July 2, 2017 at 9:50 am #122974

MrBrian

AskWoody_MVP

July 2, 2017 at 3:16 pm #122988

anonymous

Guest

July 4, 2017 at 5:32 pm #123282

I turned off SMB1, restarted my computer, tried to print something, printer would not print (printer is not wireless).  Bluetooth keyboard acted like it had been turned off after 30 minutes even  though it had only been a minute or so.  Had to turn SMB1 back on, and restart computer.  Printer went back to working and bluetooth keyboard started working again.  I am not tech savy enough to do work arounds.  I have Win 8.1 64 bit.

• PKCano

  Manager

  July 4, 2017 at 5:39 pm #123284

  Old printer? Older computer upgraded to Win8.1?
  Update the printer drivers (from the printer mfg’s website) and see if there is a bluetooth driver update from the computer OEM or the blutooth device mfg.
  Then give it one more try.
  You can always turn SMB1 back on.

anonymous

Guest

July 4, 2017 at 8:02 pm #123302

@PKCano:  Printer is old, but computer was bought with 8.1 already on it back in 2014, I think).  I will try your suggestions.  May be awhile before I get back to you.  Thank you.

anonymous

Guest

July 21, 2017 at 10:54 am #125904

hello

is it safe to disable lanmanworkstation service ?

• satrow

  AskWoody MVP

  July 21, 2017 at 11:28 am #125912

  I have, no obvious drawbacks that I’ve noticed, see #post 122993 above.

• ch200

  AskWoody_MVP

  August 5, 2017 at 9:04 am #128066

  Normally it is not safe, but this depends for what you use your machine.
  You would not be able to use any network share or printer not connected via USB.
  If you are only browsing the internet and read email, that would likely work, but it is still bad practice and you may hit roadblocks in the future not knowing why.

MrBrian

AskWoody_MVP

July 27, 2017 at 11:23 am #126658

MrBrian

AskWoody_MVP

August 5, 2017 at 7:47 am #128059

1 user thanked author for this post.

• ch200

  AskWoody_MVP

  August 5, 2017 at 9:02 am #128065

  Enterprise grade products not supporting any other version of SMB than 1.0 – Citrix XenServer latest versions with the latest patches, used among others by AWS.
  In this case is about the so called SMB/CIFS ISO Library which is normally not critical from a security standpoint as it contains only known ISO images, but this means that the server hosting the share containing the library has to support SMB1 in general.
  Latest posts on August 1, 2017.
  https://discussions.citrix.com/topic/386484-what-is-the-smb-protocol-version-for-an-smb-iso-library/

• woody

  Manager

  August 5, 2017 at 9:41 am #128070

  It’s not installed, but it’s not removed in the Fall Creators Update, aka 1709, aka RS3.

• Noel Carboni

  AskWoody_MVP

  August 5, 2017 at 10:18 am #128079

  Does anyone besides me think that having error messages from Windows today, in 2017, in a modern version of Windows, that read like the following is inexcusable?

  From the article:

  Unspecified error 0x80004005

  System Error 64

  Error 58

  Oh, that’s right, I forgot… With Windows 10 we’re not supposed to care about errors any more… It’s SO hard to stay hypnotized nowadays…

  -Noel

  Attachments:

  You must be logged in to access attached files.