In this demonstration, you will learn how to audit the SMB V1 usage and how to enable it if it's absolutely
required.
Then we will dive into the security capabilities of SMB version two or three.
And in this part, I will work with you to enable SMB signing an encryption on an SMB share.
As we revisit the diagram, we will be working on the Domain Admins Management Workstation.
We have an existing file share which is managed by file server one.
The group policies will be configured under the main controller.
We begin by looking at SMB version one.
You are currently logged in to the management machine.
Let's open up PowerShell and take a look at what the current SMB V1 configuration is.
You will issue the command, get SMB server configuration, and we will pip us to select specifically
to audit SMB one access, and we can see that the auditing capability is disabled.
Now let's take a look to see if SMB version one is enabled.
You will issue the command, get SMB server configuration picked by Select and enable SMB one protocol
and the results returned back as false.
So this shows us that SMB version one is disabled.
Now, bear in mind that this is a Windows ten machine.
So by default, SMB version one is disabled.
Let's take a look at the configuration on a server.
Since all of our servers are running server 2019, you will log in to the file server to see if smb
v one is enabled to view the SMB one configuration on file server one.
You will do this from server manager.
Once you have server manager open, you will add file server one and then right click and click on Windows
PowerShell so that we can run the same PowerShell commands on file server one.
The first thing that you will do is see if SMB version one is enabled, and you will do this by running
the PowerShell command, and you'll notice that the results returned back as false.
Now let's take a look.
If SMB version one auditing is enabled and you'll see that this is disabled as well.
Now, why are we looking at SMB one auditing?
Well, auditing SMB version one usage can be very useful when you need to determine which clients are
attempting to connect to the SMB server.
Using SMB version one, you have the ability to enable auditing on Windows Server 2016, Windows ten
and Windows Server 2019.
When you have SMB version one auditing enabled.
And should you have any clients that attempt to connect with SMB version one, you will have an event
3000, which will appear in the Microsoft Windows SMB server audit event log.
And within that log you will have the ability to identify each client that attempts to connect using
SMB version one, and you'll see a snippet of the log on your screen.
You can enable SMB V one, either via PowerShell or by adding additional features within Windows.
To enable this within PowerShell, you'll issue the command set SMB server configuration followed by
the enable SMB one protocol with the value of true.
Let's take a look at how you can do this using the graphical way you will navigate.
Get back to server manager.
And by right clicking on file server one, you will click on add roles and features.
You will go through the wizard and select role based or feature based installation.
Ensure that your survey is selected.
We are not adding any additional server roles, so we are more interested in the features and under
features.
If you scroll down, you will see there's an option for SMB 1.0 slash CFC file sharing support.
By default.
This is disabled, but you can enable it by taking the box and clicking on next to install.
Since one of the objectives of the company is to move away from unsecure protocols, we are not going
to enable this but rather ensure that it is disabled.
And to force disablement.
We're going to look at how we can do this using the group policy to configure the group policy.
You will navigate to the group policy management.
This can be found under tools on server manager and group policy management.
Since we want to disable this at a domain level, let's edit the default domain policy.
You can, of course, create a specific policy for SMB configuration settings, so you will right click
the default domain policy and click on edit.
And within the default domain policy, we need to configure registry entries.
Now, in order to disable SMB version one, you would need to disable it both for server and for client.
Let's start with server configuration.
In order to disable this for a server, we would need to configure a registry key.
To do this, you will navigate to computer configuration, expand preferences, window settings and
click on registry.
On the registry node, you will now right click click on new and click on Registry Item.
In the New Registry Properties box.
Your action would be to create an under hive.
We will keep this as the key.
I underscore local underscore machine and for a key path we will select HQ.
I underscore local underscore machine system, current control set services Lendman Server and we will
select parameters undervalue name you will type SMB one value type would be a keyword and your data
would be zero.
You'll click on okay and this disables the SMB one server components.
It's highly recommended to make a good backup of your registry before you go ahead and modify any registry
settings.
So please exercise caution, especially when configuring registry settings from a group policy.