Is Your Windows SMB Secure? A Quick Guide to Checking SMB Version (Windows 11/10)

Table of Contents

SMB or Server Message Block Protocols are essential for connecting your computer to external servers. Windows operating systems inherently support these protocols, although they are initially disabled in the Out-Of-Box Experience (OOBE). Currently, modern Windows versions, including Windows 11 and 10, are compatible with SMBv1, SMBv2, and SMBv3. The specific SMB version required for connection varies depending on the server’s configuration. Users of older systems like Windows 8.1 or Windows 7 can also verify if SMB is enabled on their machines. This guide will detail how to check the SMB version on your Windows system.

Understanding SMB Versions and Their Importance¶

For users on Windows 11/10 or Windows 8.1, disabling SMB v3 or SMB v2 is generally not recommended. Beyond potential connectivity issues, disabling these versions can lead to significant functionality losses. SMB v3, in particular, offers a suite of advanced features crucial for modern network environments:

• Transparent Failover: Ensures uninterrupted client reconnection to cluster nodes during maintenance or failovers, maintaining seamless access to resources.
• Scale Out: Enables concurrent access to shared data across all file cluster nodes, improving performance under heavy load and collaborative environments.
• Multichannel: Aggregates network bandwidth and provides fault tolerance by utilizing multiple network paths between the client and server, enhancing both speed and reliability.
• SMB Direct: Incorporates RDMA networking support, delivering exceptionally high performance with reduced latency and lower CPU utilization, ideal for demanding applications.
• Encryption: Provides end-to-end encryption, safeguarding data from eavesdropping on potentially untrusted networks, a vital security feature.
• Directory Leasing: Improves application responsiveness in branch offices through efficient caching mechanisms, reducing latency and improving user experience.
• Performance Optimizations: Includes specific optimizations for small, random read/write I/O operations, enhancing overall storage performance.

Similarly, for Windows 7 users, disabling SMB v2 is also discouraged. SMB v2 brings substantial improvements over its predecessor, offering benefits that impact performance and efficiency:

• Request Compounding: Bundles multiple SMB 2 requests into a single network request, reducing network overhead and improving efficiency.
• Larger Reads and Writes: Optimizes data transfer by supporting larger read and write operations, making better use of faster network infrastructures.
• Caching of Folder and File Properties: Clients maintain local copies of folder and file properties, reducing server load and speeding up access to frequently used data.
• Durable Handles: Allows for transparent reconnection to the server in case of temporary network disruptions, ensuring application stability and data access continuity.
• Improved Message Signing: Employs HMAC SHA-256 as the hashing algorithm, replacing the older MD5, thus enhancing the security and integrity of data transmission.
• Improved Scalability for File Sharing: Significantly increases the number of users, shares, and open files a server can handle, making it suitable for larger and more demanding environments.
• Support for Symbolic Links: Enables the use of symbolic links, providing greater flexibility in file system management and organization.
• Client Oplock Leasing Model: Limits data transferred between client and server, improving performance on high-latency networks and boosting SMB server scalability, particularly beneficial in distributed environments.
• Large MTU Support: Fully utilizes 10-Gigabit Ethernet networks through support for larger Maximum Transmission Units (MTU), increasing network throughput.
• Improved Energy Efficiency: Allows clients with open files to a server to enter sleep states, reducing energy consumption without disrupting network operations.

Methods to Check SMB Version on the Server¶

To determine the installed SMB version on your Windows server, you can use two primary methods: PowerShell and Registry Editor.

1] The PowerShell Method¶

PowerShell provides a straightforward command-line interface to check the enabled SMB versions.

Checking SMB v1 on Windows 11/10 and Windows 8.1¶

To check if SMB v1 is enabled on Windows 11/10 and Windows 8.1, execute the following PowerShell command:

Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

Checking SMB v2/v3 on Windows 11/10 and Windows 8.1¶

To check if SMB v2/v3 is enabled on Windows 11/10 and Windows 8.1, use this PowerShell command:

Get-SmbServerConfiguration | Select EnableSMB2Protocol

Checking SMB v1 on Windows 7¶

For Windows 7, use the following PowerShell command to check SMB v1 status:

Get-Item HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters | ForEach-Object {Get-ItemProperty $_.pspath}

Checking SMB v2 on Windows 7¶

Similarly, for Windows 7 SMB v2 status, execute:

Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters | ForEach-Object {Get-ItemProperty $_.pspath}

The command output will indicate whether the specified SMB version is enabled. A return value of True signifies that the SMB version is enabled, while False indicates it is disabled.

2] The Registry Editor Method¶

The Registry Editor provides a graphical interface to check SMB settings.

1. Open Registry Editor by typing regedit in the Start Search and pressing Enter.

2. Navigate to the following registry key:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
   

3. Within this key, look for DWORD values named SMB1 or SMB2.

4. Examine the Value Data for these DWORDs.

   • If the Value Data is set to 0, the corresponding SMB version is disabled.
   • Any other value indicates that the SMB version is enabled.

Methods to Check SMB Version on Clients¶

To check the SMB version on client machines, you can again utilize PowerShell and, for Professional or Enterprise editions of Windows, the Group Policy Editor.

1] The PowerShell Method¶

Similar to server-side checks, PowerShell commands can be used on client machines to verify SMB versions. Ensure you run Command Prompt or PowerShell with Administrator privileges.

Checking SMB v1 on Windows 11/10 and Windows 8.1 (Client)¶

To check SMB v1 on client versions of Windows 11/10 and Windows 8.1, use this command in Command Prompt or PowerShell:

sc.exe qc lanmanworkstation

Checking SMB v2/v3 on Windows 11/10 and Windows 8.1 (Client)¶

The same command is used to check SMB v2/v3 client-side:

sc.exe qc lanmanworkstation

This command provides service configuration details, which can be analyzed to infer SMB client configuration.

2] The Group Policy Editor Method¶

Note: The Group Policy Editor method is not available on Windows 11/10 Home or equivalent Home editions of Windows 8 or Windows 7. It requires Professional, Enterprise, or Education editions.

1. Open the Local Group Policy Editor by typing gpedit.msc in the Run dialog box (Win + R) and pressing Enter.

2. Navigate to the following path in the Group Policy Editor:

   Computer Configuration > Windows Settings

3. Under Registry, look for a Registry Item with the following properties:

   • Action: Update
   • Hive: HKEY_LOCAL_MACHINE
   • Key Path: SYSTEM\CurrentControlSet\services\mrxsmb10
   • Value Name: Start
   • Value type: REG_DWORD
   • Value Data: 4

4. If the Value Data is set to 4, SMB v1 is disabled on the client. Any other value (typically 3 for automatic, 2 for enabled, etc.) indicates it is not disabled through this policy.

By utilizing these methods, administrators and users can effectively check the SMB versions enabled on both Windows servers and clients, ensuring appropriate configuration for network security and functionality. Understanding the enabled SMB versions is crucial for troubleshooting connectivity issues and maintaining a secure and efficient network environment.

Knowing your SMB configuration is the first step towards ensuring your Windows systems are both functional and secure within your network. Regularly checking and managing SMB versions can help prevent vulnerabilities and optimize network performance.

Do you have any experiences checking or managing SMB versions in your Windows environment? Share your thoughts and questions in the comments below!