Find and switch off SMBv1 on Windows Server

SMBv1 is the 1980s-era version of Windows file sharing. It has serious known weaknesses and Microsoft strongly advises against using it. Newer Windows versions don't install it, but servers that were upgraded in place, or built from old images, can still have it. This guide checks for it, logs anything still using it, then switches it off safely.

Before you start

• You need local administrator rights on the server, and an elevated PowerShell window (right-click Windows PowerShell and choose Run as administrator).
• Microsoft says SMBv1 is not installed by default on Windows Server 2019 and later, Windows 11, and Windows 10 except Home and Pro. Older servers and upgraded machines are the ones to check.
• Pick a maintenance window. Removing the feature restarts the server.

Steps

1. Check whether SMBv1 is on

1. Open PowerShell as administrator on the server.
2. Check whether the SMBv1 server is enabled:

   Get-SmbServerConfiguration | Select EnableSMB1Protocol

   False means the SMBv1 server is off. True means it is on.
3. Check whether the SMBv1 feature is installed at all:

   Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

   Look at the State line. Disabled means it isn't installed. Enabled means it is.
4. If both show it is off, you're done. Skip to "Check it worked".

2. Find out what still uses SMBv1

1. Turn on SMBv1 access auditing:

   Set-SmbServerConfiguration -AuditSmb1Access $true

   Type Y and press Enter if asked to confirm.
2. Leave it running for a few days, ideally across a normal working week, so devices that only connect occasionally show up.
3. Open Event Viewer (press Windows + R, type eventvwr.msc, press Enter).
4. Go to Applications and Services Logs > Microsoft > Windows > SMBServer > Audit.
5. Look for Event ID 3000. Each one is an SMBv1 connection attempt, and the details show which client made it.
6. No 3000 events means nothing is using SMBv1. If you find some, update or replace those devices first. Microsoft recommends updating the device rather than keeping SMBv1.

3. Switch off the SMBv1 server (no restart)

1. Run:

   Set-SmbServerConfiguration -EnableSMB1Protocol $false

   Confirm with Y. Microsoft says no restart is needed for this command.
2. This stops the server accepting SMBv1 connections straight away, and is easy to reverse if something breaks.

4. Remove the SMBv1 feature completely

1. Option A, PowerShell:

   Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

2. Option B, Server Manager (older Windows Server versions):
   1. Open Server Manager.
   2. On the Dashboard, under Configure this local server, select Add roles and features.
   3. On Before you begin, select Start the Remove Roles and Features Wizard, then Next.
   4. On Select destination server, confirm your server is selected, then Next.
   5. On Remove server roles, select Next.
   6. On Remove features, clear SMB 1.0/CIFS File Sharing Support, then Next.
   7. On Confirm removal selections, check the feature is listed, then select Remove. Restart when prompted.

Check it worked

1. After the restart, run:

   Get-SmbServerConfiguration | Format-List EnableSMB1Protocol
   Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

   You should see EnableSMB1Protocol : False and State : Disabled.
2. From a normal workstation, open a share on the server (for example \\SERVERNAME\share) to confirm modern clients still connect.
3. Check any devices you found in step 2, such as scanners that save to a share, still work.
4. Once you're happy, you can turn auditing back off:

   Set-SmbServerConfiguration -AuditSmb1Access $false

Sources

• Microsoft Learn: How to detect, enable and disable SMBv1, SMBv2, and SMBv3 in Windows