NHS hit hard by ransomware / Wannacry Patching

[JordanT91]

I've deployed a GPO that adds the SMB1 key with a value of 0 to the registry (it didn't already exist). I've also deployed the startup script. My servers have had a good few restarts but the SMB1.0/CIFS feature is still ticked. Any ideas?

[Michael]

Does anybody have the Patch links? Apprentice in desperate need of assistance here! D:

 

What version(s) of Windows are you using?

[Theory]

What version(s) of Windows are you using?

We have two Windows XP and the rest are Windows7.

[AngryITGuy]

Erm. It appears our Sophos UTMs use SMB1 to authenticate. Somehow.

 

It's the same for our SmoothaWall appliance.

 

Disabling SMB1 on our domain controllers broke the NTLM authentication.

[lovelldr]

You can run this powershell as admin (with the AD Powershell module installed, so on a DC) and it will scan your domain and tell you what state the machines are in:

 

https://github.com/kieranwalsh/PowerShell/blob/master/Get-WannaCryPatchState/Get-WannaCryPatchState.ps1

 

Hmmm, just ran this ps, and it's still going through at the minute, but apparently, my machine is unpatched... Even though it's got all the latest windows 10 updates?! Any ideas why that would be reported, lol...

[glen_j]

Erm. It appears our Sophos UTMs use SMB1 to authenticate. Somehow.

 

Found the same thing, queue a few phone calls for folks not being able to get on the internet.

[Michael]

Okay, I've been ill over the weekend so am a bit behind with the developments on this....

 

I have temporarily disabled SMB1 on the server, I have installed the patch that stops the vulnerability, but it wont run until the server is restarted.

 

Does the patch disable SMB1, or just it just close the vulnerability? We've already noticed an issue with disabling SMB1 (Admin Copier wont scan files to network drives)

 

The patch closes the vulnerability only. I would advise against disabling SMB1. Sophos, MFPs and other services will require SMB1.

 

Microsoft may close it at a later date, just as they have with certificates using SHA1 (this month). This will affect a lot of schools in Birmingham using e-Portal, as most are still using this.

[Michael]

We have two Windows XP and the rest are Windows7.

 

Windows XP SP3 (x86) Patch

 

Windows 7 Patch

 

Hope this helps!

[MYK-IT]

It's the same for our SmoothaWall appliance.

 

Disabling SMB1 on our domain controllers broke the NTLM authentication.

 

Just found this out for ourselves a few moments ago!.... Had to re-enable SMBv1 on DCs for now...

 

Is there a solution to this?

 

Thanks.

[localzuk]

Where have Microsoft quoted this? (Disabling SMB1)?

And as others have found, disabling SMB1 has started to break other systems. Surely it's just as quick to deploy the latest May 2017 Win10 patch!? I've done exactly this to minimise disruption at multiple sites.

They've released a few advisories on it.

 

https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

 

(For example, to further protect against SMBv1 attacks, customers should consider blocking legacy protocols on their networks).

 

An old one. https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-using-smb1/

[localzuk]

I think I may have to take a mixed approach here - allow SMB1 on our DCs only. Reduces the possible infection surface of the network, whilst allowing our UTMs to authenticate for the moment.

 

Its somewhat irritating that UTMs and the like haven't updated to more modern implementations of SMB.

[clockend25]

Anyone had any issues with Papercut following the disabling of SMB1?

[MYK-IT]

The patch closes the vulnerability only. I would advise against disabling SMB1. Sophos, MFPs and other services will require SMB1.

 

Microsoft may close it at a later date, just as they have with certificates using SHA1 (this month). This will affect a lot of schools in Birmingham using e-Portal, as most are still using this.

 

So, with SmoothWall Authentication issues, and what @Michael mentioned too (Sophos etc,) is disabling SMBv1 still a given step to take? or just apply the MS patches?

 

How are the schools that have deployed a startup script to disable SMBv1 on clients (Windows 7+) getting on? Is this causing other related problems?

 

Thanks

[FN-GM]

PaperCut MF Version: 17.0.5 (Build 39928)

 

All fine here.

[Arthur]

Is there a solution to this?

Use Kerberos instead of NTLM?

[RLR]

So, with SmoothWall Authentication issues, and what @Michael mentioned too (Sophos etc,) is disabling SMBv1 still a given step to take? or just apply the MS patches?

 

How are the schools that have deployed a startup script to disable SMBv1 on clients (Windows 7+) getting on? Is this causing other related problems?

 

Thanks

 

If you installed the MS patches you don't need to worry about disabling SMBv1.

[TechMonkey]

Odd, I have disabled SMBv1 on our DCs and Smoothwall Auth still works.

 

AS for where does MS suggest to disable SMBv1 - https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-using-smb1/

 

If you installed the MS patches you don't need to worry about disabling SMBv1.

Unless there are other issues with SMBv1 that the patch doesn't cover. SMBv1 is archaic, out of date and insecure. Nothing should be using it anymore. How can we decry firms using XP but then say it is OK to use SMBv1!!

 

Sorry that turned in to abit of a rant.

Edited May 15, 2017 by TechMonkey

[Stormborn15]

I did it via registry. It didn't need a restart.

 

I can't change any features because the server knows it needs a restart (from the installed update)

 

Look here

 

goo.gl/c6FLhi

 

Thank you

[Michael]

They've released a few advisories on it.

 

https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/

 

 

 

[/font][/color]An old one. https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-using-smb1/

 

I really would approach with caution. The amount of services it breaks, it just isn't worth it in my opinion. And because SMB all share the same stack, you inadvertently disable SMB2 and SMB3 (depending on the OS in question). All very messy and much better to just prioritise the patch.

[Stormborn15]

Today is just going to be wonderful... I'm also alone as my mentor is on a residential... Have mercy on my soul.

Lone NM here too... and new to scripting... good luck @Theory

[Geoff]

If you installed the MS patches you don't need to worry about disabling SMBv1.

 

Well, performance would be another reason.

[gumbygaz]

Anyone had any issues with Papercut following the disabling of SMB1?

 

I did, but only because noticed I'd disabled smb2 on that server and not smb1 . Renabled smb2 and it was back up and running ok.

 

Not had any issues with our Smoothwall and SMB1 being disabled on DC..yet? Running NTLM auth.

[clockend25]

OK. We've got a number of users who are printing but nothing is showing in the print queue. The jobs eventually come through much later.

[JJonas]

Erm. It appears our Sophos UTMs use SMB1 to authenticate. Somehow.

 

ah, so if you have Sophos and used Joses script to turn it off how do you turn it back on again?

 

-Edit- found it...

 

sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi

sc.exe config mrxsmb10 start= auto

Edited May 15, 2017 by JJonas

[gsk]

I did it via registry. It didn't need a restart.

 

I can't change any features because the server knows it needs a restart (from the installed update)

 

Look here

 

http://goo.gl/c6FLhi

 

It says further down the article that a restart is needed for the registry changes to take effect.