# SMBv3.1.1 enabled count should be retrievable

SMBv3.1.1 is the latest version of the Server Message Block protocol and includes important security enhancements:

Source: https://maester.dev/docs/tests/AD-DC-03

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Domain controllers · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-DC-03
```

## Overview

SMBv3.1.1 is the latest version of the Server Message Block protocol and includes important security enhancements:

- **Pre-authentication integrity**: Prevents man-in-the-middle attacks
- **AES-128-GCM encryption**: Stronger encryption for SMB traffic
- **Secure dialect negotiation**: Prevents downgrade attacks
- **Required for Windows 11**: Modern Windows versions prefer SMBv3.1.1

Having SMBv3.1.1 enabled ensures your domain controllers can support the most secure SMB communications.

#### Control Type

**Preventive**

#### Security Recommendation

Enable SMBv3.1.1 on all domain controllers running Windows Server 2016 or later to ensure maximum SMB security.

To verify SMBv3.1.1 status:
```powershell
Get-SmbServerConfiguration | Select-Object EnableSMB3_1_1Protocol
```

#### How the Test Works

This test queries the SMB server configuration on each domain controller to check if SMBv3.1.1 protocol is enabled. It reports the count and names of DCs with this protocol enabled.

#### Related Tests

- `Test-MtAdDcSmbv1EnabledCount` - SMBv1 protocol status (should be disabled)
- `Test-MtAdDcSmbSigningEnabledCount` - SMB signing configuration

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-DC-03 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Domain controllers |
| Area | Infrastructure hardening |
| Resource type | DomainController |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdDcSmbv311EnabledCount](https://github.com/maester365/maester/blob/main/tests/ad/domain-controller/Test.AD-DC-03.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\Microsoft\Windows\SMB:MSFT_SmbServerConfiguration:Read |

</details>

## Source

- Test: [`tests/ad/domain-controller/Test.AD-DC-03.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/domain-controller/Test.AD-DC-03.ps1)
- Documentation: [`tests/ad/domain-controller/Test.AD-DC-03.md`](https://github.com/maester365/maester/blob/main/tests/ad/domain-controller/Test.AD-DC-03.md)