SMBv3.1.1 enabled count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Domain controllers · All checks

Run this check

Invoke-Maester -TestId AD-DC-03

Overview

SMBv3.1.1 is the latest version of the Server Message Block protocol and includes important security enhancements:

• Pre-authentication integrity: Prevents man-in-the-middle attacks
• AES-128-GCM encryption: Stronger encryption for SMB traffic
• Secure dialect negotiation: Prevents downgrade attacks
• Required for Windows 11: Modern Windows versions prefer SMBv3.1.1

Having SMBv3.1.1 enabled ensures your domain controllers can support the most secure SMB communications.

Control Type

Preventive

Security Recommendation

Enable SMBv3.1.1 on all domain controllers running Windows Server 2016 or later to ensure maximum SMB security.

To verify SMBv3.1.1 status:

Get-SmbServerConfiguration | Select-Object EnableSMB3_1_1Protocol

How the Test Works

This test queries the SMB server configuration on each domain controller to check if SMBv3.1.1 protocol is enabled. It reports the count and names of DCs with this protocol enabled.

Related Tests

• Test-MtAdDcSmbv1EnabledCount - SMBv1 protocol status (should be disabled)
• Test-MtAdDcSmbSigningEnabledCount - SMB signing configuration

Details

Every attribute of this check

Field	Value
Test ID	AD-DC-03
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Domain controllers
Area	Infrastructure hardening
Resource type	DomainController
MITRE ATT&CK	None
PowerShell test	Test-MtAdDcSmbv311EnabledCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\Microsoft\Windows\SMB:MSFT_SmbServerConfiguration:Read

Source

• Test: tests/ad/domain-controller/Test.AD-DC-03.ps1
• Documentation: tests/ad/domain-controller/Test.AD-DC-03.md