NHS hit hard by ransomware / Wannacry Patching

[localzuk]

ah, so if you have Sophos and used Joses script to turn it off how do you turn it back on again?

Powershell on the server - https://support.microsoft.com/en-gb/help/2696547/how-to-enable-and-disable-smbv1,-smbv2,-and-smbv3-in-windows-vista,-windows-server-2008,-windows-7,-windows-server-2008-r2,-windows-8,-and-windows-server-2012

[Tesla]

It says further down the article that a restart is needed for the registry changes to take effect.

 

Didn't need it for me, about five minutes after i disabled it, admin team said they couldn't scan, i then enabled it, then they could, then disabled it again, and they couldn't.

[sippo]

I'm just going to turn all the servers off and go down the pub.

 

That's the safest option, til it all blows over.

[MatZeRO]

We disabled SMBv1 and have no issues with any other products including Papercut and Sophos.

 

We are talking to NRS about our cashless catering because we have several tills that still run XP embedded.

Edited May 15, 2017 by MatZeRO
spelling

[gsk]

Didn't need it for me, about five minutes after i disabled it, admin team said they couldn't scan, i then enabled it, then they could, then disabled it again, and they couldn't.

 

Very useful to know, thanks.

[localzuk]

I really would approach with caution. The amount of services it breaks, it just isn't worth it in my opinion. And because SMB all share the same stack, you inadvertently disable SMB2 and SMB3 (depending on the OS in question). All very messy and much better to just prioritise the patch.

Yes, some legacy stuff will break. There's no question about that, but in the immediate short term, ensuring SMB1 is disabled is a very quick way of preventing propagation. Rolling out a patch is a little longer of a process.

 

It may be that we can re-enable it in some places but for now, its going off, per MS's advice.

[jonathan.lees]

Disabling SMB1 on our DC's broke our Sophos UTM SSO so we had to turn it back on

[Lonix]

Am I the only one that has been watching this unfold since Friday with one thing on my mind? Reactive and not proactive.

 

I've been watching Twitter and you have the usual Propaganda/Political rubbish appearing. When it really all boils down to the NHS IT cuts that consistently happen every 5-7 Years. A few of my friends were made redundant when they centralised a lot. When you cut down budgets you stop renewing annual fees (like the XP Support) and when you cut staff who's going to be upgrading those XP machines to Windows 7? Not to mention when do IT staff working 9-5 mon-fri sort out the machines in use during those hours.

 

As a few people have said, they were warned and ignored. Reactive and not Proactive. They will throw money at IT (or shall I say to those who are clueless about IT but are in charge/politicians - perhaps Hunt) while those who actually are clued up get little to nothing.

 

This entire thing sums up IT and certainly not just education. Still when it's all working again I'm sure after 12 months no one will ask - What do IT do all day? Play games? drink coffee?........................

 

My heart goes out to those working flat out while stopping to answer the phone every 5 minutes "is it working yet".............

[djm968]

I think the Cyber Attack may have actually disabled Jeremey Hunt…… anyone heard anything from him yet?

[Michael]

That's hilarious!

[mullet_man]

So far disabling smbv1 hasn't done any obvious damage. Time will tell.

[mb2k01]

We disabled SMBv1 and have no issues with any other products including Papercut and Sophos.

 

We are talking to NRS about our cashless catering because we have several tills that still run XP embedded.

 

I think this will do the trick for your tills (*think* not tried yet!):

http://www.catalog.update.microsoft.com/search.aspx?q=4012598

[gshaw]

So have you all disabled SMBv1 on everything? Since the rollups came in there's too many failures in WSUS for me to be 100% certain on the clients so adding Jose's startup script sounds like a good idea.

[MatZeRO]

We have here and we have had no issues. If you do have issues you can always turn it back on.

[TwistedHelixis]

Jose's startup script

 

Is that somewhere in these posts???

[Theory]

Lone NM here too... and new to scripting... good luck @Theory

Lone Apprentice, either going to nail it or royally screw up:confused:

[eddyc]

 

Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol -NoRestart

 

... and on Windows Server 2012 R2/2016 you would run:

 

Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol -NoRestart; Remove-WindowsFeature FS-SMB1

 

I've ran this on a few 2012 R2 and 2016 boxes, given them a reboot and then running

 

 Get-SMBServerConfiguration in powershell 

still says its set to true.

 

Am I missing something, I get a success message before I reboot.

[SteveB_NI]

Can I ask - If I apply the May or April roll-ups - does this include the fix for the issue? Or do I also need to specifically install the Windows update from March?

[Michael]

I haven't disabled SMB1 anywhere (for everyone's reference). Simply deploy the update, then go and check it's downloading/installing on a few. Nice and easy.

[localzuk]

Can any Sophos UTM users please vote here: - Remove UTM SSO reliance on insecure SMB 1.0 ? Sophos Ideas

 

Sophos are escalating it based on Microsoft's advice but some votes might help...

[FN-GM]

Voted!

[smurfomatic]

Just re-enabled SMB1 on the servers as it turns out no-one can scan with it switched off. Great to know our new top quality copiers are so up to date...

 

Had to remove the update from our (soon to be retired) 2003 server as it messed up the login script.

 

Also really helpful when you put a batch file into the staff network share (some PCs not updating GP to get the startup script) then someone deletes it!

[DJ-1701]

Just re-enabled SMB1 on the servers as it turns out no-one can scan with it switched off. Great to know our new top quality copiers are so up to date...

 

Let me guess Ricoh? Had the same issue. Trying to setup scanning to e-mail for those that use it.

[clockend25]

Issues with Papercut are diminishing; users needed to reboot after we'd disabled SMB1 across servers and clients. Seems to be functioning correctly now.

[smurfomatic]

"Let me guess Ricoh? Had the same issue. Trying to setup scanning to e-mail for those that use it."

 

Ricoh for the big reprographics copier yes, but looking at our smaller RISO machines they all use SMB but don't specify which version.

 

Scan to email is probably the next approach, just seems crazy to have to send a document out via Google mail and come back again to the room next to the copier!