SMB1 is still enabled on plenty of Windows installs and signing is optional on both sides. Audit first, disable the feature, require signing on client and server, then check the dialect a real connection negotiates.
Audit with **Set-SmbServerConfiguration -AuditSmb1Access $true**, remove the feature with **Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol**, and set **RequireSecuritySignature** on both client and server.
**Get-SmbServerConfiguration** reports the protocol versions and the signing state in one object. Signing is often enabled but not required, which is the weaker setting.
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol,EnableSMB2Protocol,RequireSecuritySignature
Get-SmbClientConfiguration | Select-Object RequireSecuritySignature,EnableSecuritySignatureThe audit switch writes an event every time an SMB1 connection is accepted. Let it run for a day before you remove the feature, otherwise an old copier or NAS goes silent at the worst moment.
Set-SmbServerConfiguration -AuditSmb1Access $true -Force
Get-WinEvent -LogName Microsoft-Windows-SMBServer/Audit -MaxEvents 20 | Select-Object TimeCreated,Message**SMB1Protocol** is a Windows optional feature, so it is removed like one. The client and server halves are listed separately and the parent feature controls both.
Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol | Select-Object FeatureName,State
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart
Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol | Select-Object StateSigning costs a little throughput and removes a whole class of tampering. Set it on the client as well, otherwise the machine will still accept an unsigned share from a device that does not care.
Set-SmbClientConfiguration -RequireSecuritySignature $true -EnableSecuritySignature $true -Force
Set-SmbServerConfiguration -RequireSecuritySignature $true -Force
Get-SmbServerConfiguration | Select-Object RequireSecuritySignature**Get-SmbConnection** lists the dialect of every live connection. 3.1.1 is the target; a value of 1.5 after your changes means an old client is still in the mix.
New-SmbMapping -LocalPath Z: -RemotePath \\nas01\projects -Persistent $false
Get-SmbConnection | Select-Object ServerName,ShareName,Dialect,Encrypted
Remove-SmbMapping -LocalPath Z: -ForceWhen a single device fails, re-enable only the client half and keep the server side clean. The device then talks to the legacy box while nothing on your PC is served over SMB1.
Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol-Client -NoRestart
Get-WindowsOptionalFeature -Online | Where-Object FeatureName -like 'SMB1*' | Select-Object FeatureName,StateIt was using SMB1. Update the firmware or enable SMB2 on the device; if that is impossible, re-enable only SMB1Protocol-Client.
Expect a few percent on gigabit links. If it is far worse, the link dropped to 100 Mbps; check the adapter speed before blaming signing.
The DISM module needs an elevated shell. Start PowerShell as administrator and run the same command again.
Check the client configuration too. The requirement must be on the side that initiates the connection.
No. Windows 10 and 11 negotiate SMB2 or SMB3 by default, and the feature is only present for legacy devices.
No. Signing proves the data came from the server; encryption hides the content on the wire. Both are set per connection, and SMB3 encryption is worth enabling on untrusted networks.
Yes, through Group Policy under Computer Configuration, Administrative Templates, Network, Lanman Server and Lanman Workstation. The four settings mirror the cmdlets above.
Re-enable the feature with Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart and set RequireSecuritySignature back to $false on both client and server with the same cmdlets.
Free · no account needed · tracks your progress