0

This microsoft webpage provides guidance, amongst other things, on disabling SMB1 in Windows 2008.

It mentions a registry key HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SMB1.

I haven't yet followed any of those instructions but when I inspect HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters on a W2008 machine there is no entry for SMB1 (or any other entries which appear to relate to SMB).

What is the significance of this? Is it possible to have configured the machine so that it knows nothing about SMB?

2

WCry exploits a problem of an unpatched Windows system. The problem is located in the SMBv1 (Server Message Block) implementation.

If the registration key HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SMB1 (type should be DWORD) is set to 0, it's use is disabled. The default value is 1, i.e. if the key is not present in the registry, it will be treated like it has the value 1.

| improve this answer | |
  • 1
    In other words, SMB1 is on by default you must create the key/value if it doesn't exist and you want to turn it off. – Ryan Bolger May 15 '17 at 14:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.