AD-DC-02 - SMBv1 should be disabled on all domain controllers
Overview
SMBv1 (Server Message Block version 1) is an outdated protocol with significant security vulnerabilities:
- EternalBlue exploit: Used in WannaCry and NotPetya ransomware attacks
- No encryption: SMBv1 traffic is not encrypted
- No integrity checks: Vulnerable to man-in-the-middle attacks
- Deprecated by Microsoft: Microsoft strongly recommends disabling SMBv1
Domain controllers with SMBv1 enabled pose a critical security risk as they are high-value targets for attackers.
Control Type
Preventive
Security Recommendation
Disable SMBv1 on all domain controllers immediately.
To disable SMBv1 on a domain controller:
#### Check current status
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol
#### Disable SMBv1
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
#### Disable SMBv1 feature (requires restart)
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
How the Test Works
This test queries the SMB server configuration on each domain controller to check if SMBv1 protocol is enabled. It reports:
- Number of DCs with SMBv1 enabled
- Names of affected DCs
- Overall security status
Related Tests
Test-MtAdDcSmbSigningEnabledCount- SMB signing configurationTest-MtAdDcSmbv311EnabledCount- SMBv3.1.1 protocol status
Test Metadata
| Field | Value |
|---|---|
| Test ID | AD-DC-02 |
| Severity | High |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Domain controllers |
| Area | Infrastructure hardening |
| Resource type | DomainController |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1210 Exploitation of Remote Services |
| Supports controls | nist-800-53-r5:CM-7 |
| PowerShell test | Test-MtAdDcSmbv1EnabledCount |
| Services | ActiveDirectory |
Source
- Test:
tests/ad/domain-controller/Test.AD-DC-02.ps1 - Documentation:
tests/ad/domain-controller/Test.AD-DC-02.md