SMBv1 should be disabled on all domain controllers

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Domain controllers · All checks

Run this check

Invoke-Maester -TestId AD-DC-02

Overview

SMBv1 (Server Message Block version 1) is an outdated protocol with significant security vulnerabilities:

• EternalBlue exploit: Used in WannaCry and NotPetya ransomware attacks
• No encryption: SMBv1 traffic is not encrypted
• No integrity checks: Vulnerable to man-in-the-middle attacks
• Deprecated by Microsoft: Microsoft strongly recommends disabling SMBv1

Domain controllers with SMBv1 enabled pose a critical security risk as they are high-value targets for attackers.

Control Type

Preventive

Security Recommendation

Disable SMBv1 on all domain controllers immediately.

To disable SMBv1 on a domain controller:

#### Check current status
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol

#### Disable SMBv1
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force

#### Disable SMBv1 feature (requires restart)
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

How the Test Works

This test queries the SMB server configuration on each domain controller to check if SMBv1 protocol is enabled. It reports:

• Number of DCs with SMBv1 enabled
• Names of affected DCs
• Overall security status

Related Tests

• Test-MtAdDcSmbSigningEnabledCount - SMB signing configuration
• Test-MtAdDcSmbv311EnabledCount - SMBv3.1.1 protocol status

Details

Every attribute of this check

Field	Value
Test ID	AD-DC-02
Severity	High
Suite	Active Directory
Product	Active Directory
Feature	Domain controllers
Area	Infrastructure hardening
Resource type	DomainController
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1210 Exploitation of Remote Services
Supports controls	nist-800-53-r5:CM-7
PowerShell test	Test-MtAdDcSmbv1EnabledCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\Microsoft\Windows\SMB:MSFT_SmbServerConfiguration:Read

Source

• Test: tests/ad/domain-controller/Test.AD-DC-02.ps1
• Documentation: tests/ad/domain-controller/Test.AD-DC-02.md