NHS hit hard by ransomware / Wannacry Patching

[SpuffMonkey]

In the spirit of "its an ill wind etc" - I have been able to visit my Dad in hospital for free over the weekend - as all the parking barriers are not working

[gh5000]

Just came across my first problem with disabling SMB1. Had a thought that I would just disable my backup share until the day passes tomorrow to be safe. Went to check that backups had completed successfully and the Veeam service wasn't running. Was checking another school and the Symantec services had all crashed. Panic!

 

In short both used QNAP which for both was set with a highest SMB version of 1. Can be changed by going to Control Panel -> Network Services -> Win/Mac/NFS -> Microsoft Networking tab. Click on Advanced Options, and look for Highest SMB Version.

 

Enabling this again and rerunning the backups that failed due to SMBv1 being disabled in the middle of the last backup and killing the services.

[FragglePete]

Done what I can from home, ready for a busy day tomorrow ensuring clients are patched. As a precaution, I'm shutting down the NAS box which has got the copy of the backups on that have run successfully this weekend.

 

Pete

[gh5000]

Veeam's gone a bit buggered up for me. Found a community posting which reads

I was just updating HyperV Windows 2016 hosts with Microsoft monthly (March) security patches and after restart Veeam backups stopped working from updated hosts.

 

I may have found the correct post!

[MS2011]

Anyone have deployed out removing SMBv1 from all devices using logon script or GPO? Please someone can share with me?

 

Is there any link to just download security Update for Microsoft Windows SMB Server (4013389) on W10 and Server 2008 R2 and 2012 R2

 

Thanks

[Jose]

Anyone have deployed out removing SMBv1 from all devices using logon script or GPO? Please someone can share with me?

 

Is there any link to just download security Update for Microsoft Windows SMB Server (4013389) on W10 and Server 2008 R2 and 2012 R2

 

Thanks

 

sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi

sc.exe config mrxsmb10 start= disabled

 

wack in a batch , gpo computer startup script

[Theory]

Today is just going to be wonderful... I'm also alone as my mentor is on a residential... Have mercy on my soul.

[timbo343]

Here's Sophos's guide to the wana outbreak and what can be done

https://community.sophos.com/kb/en-us/126733

 

which has links to the MS technet site that enables you to download the individual updates

https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

[Asgard]

Shots fired by Microsoft , outing the NSA as being responsible for not declaring the vulnerability

 

https://blogs.microsoft.com/on-the-issues/2017/05/14/need-urgent-collective-action-keep-people-safe-online-lessons-last-weeks-cyberattack/#sm.001wyq0x412prdbzq7w2rkc9405lb

[smurfomatic]

Added the SMB disabling startup script in Jose's post above, as well as one to force WSUS refresh as some computers still not reporting. Hopefully that'll be all because my boss is still off sick so I'm going to be dealing with this on my own...just the 150 or so computers to sort out then!

[Max_Power]

This thread has been very valuable with all the information added to it over the course of the weekend. Did all I could over the weekend, and in early today just as a precaution.

[MS2011]

On server 2008 R2 if I disable smbv1 and v2 then I can't access my file share.

 

Do I need to disable smbv2 or just v1?

[gh5000]

Just v1

[localzuk]

All I can say about all this is, I want to shoot the previous IT support for our other schools. What a bloomin' mess! Not only was Windows Update disabled via GPO in 2 schools, the actual service was disabled on the servers!! *RAGE*

[caffrey]

Phew, our MFD's are still working scanning to smb - I think this was my main concern

[Stormborn15]

Just looked at our DC and the SMB1 feature is ticked and greyed out.. don't use powershell scripting so not too good with it.. any ideas on how I can get round this? TIA

 

Also, will this affect any Apple share maps ?

Sorry, its been a long weekend and kept having nightmares about our netbooks! - duh moment !

 

Found the 'REMOVE' features bit.. going to do it now!

Edited May 15, 2017 by Stormborn15

[MS2011]

Is there any command to check SMB1 status on server 2008 and R2. Get-SmbServerConfiguration doesn't work on Server 2008 and Server 2008R2

[techie17]

Is the MS17-10 patch included in the latest monthly security updates for server 2012r2 and windows 10?

[Geoff]

Is there any command to check SMB1 status on server 2008 and R2. Get-SmbServerConfiguration doesn't work on Server 2008 and Server 2008R2

 

Run the following powershell. If the key doesn't exist or is a value other than '0' then SMB1 is enabled.

 

Get-Itemproperty "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB1

[Jobos]

I updated and removed SMB1 from the servers yesterday. All server are 2012r2 and today I'm getting some win7 clients not mapping drives and on testing \\\netlogon is not accessible but I can ping ok.

[MS2011]

I updated and removed SMB1 from the servers yesterday. All server are 2012r2 and today I'm getting some win7 clients not mapping drives and on testing \\\netlogon is not accessible but I can ping ok.

 

i had a same issue.. make sure you only remove SMB1 not SMB2.

 

Do this.. To enable SMBv2 and SMBv3 on the SMB server, run the following cmdlet:Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB2 -Type DWORD -Value 1 -Force

[JRA]

Run the following powershell. If the key doesn't exist or is a value other than '0' then SMB1 is enabled.

 

Get-Itemproperty "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB1

Okay I've just done this and the key doesn;t exist. What's the quickest non-powershall way to turn it off? Servers are fully updated though.

[Geoff]

I updated and removed SMB1 from the servers yesterday. All server are 2012r2 and today I'm getting some win7 clients not mapping drives and on testing \\\netlogon is not accessible but I can ping ok.

 

 

I would disable it on your clients too. Also make sure that your clients have SMBv2 and v3 enabled too.

Edited May 15, 2017 by Geoff

[clockend25]

Busy day yesterday updating servers and disabling SMB1. I've rolled out the SMB1 removal for clients via SCCM. Backups have completed over the weekend successfully and that server is now offline.

 

We wait, nervously.

 

[localzuk]

This map is pretty cool - https://intel.malwaretech.com/botnet/wcrypt

 

Looks like our world IT teams are very good at turning PCs off.