Things that don't work after SMB1 is disabled

[timbo343]

I thought i'd spend a few hours seeing what the wake of disabling the SMB1 protocol and patching the servers has done to some of our services and it would seem the following have issues:

 

SIMS - @PhilNeal

 

The deployment of SIMS to other machines no longer works how it used to do (see screenshot):

 

 

Both Network and Agent options are blank when there used to be machines listed in there.

 

IMPERO - @Mic_Impero

 

The deployment of the MSI no longer sees machines on the network via the network browser (see screenshot):

 

 

Only my machine is listed, before all machines that were found on the network used to be there.

 

Home Access Plus - @nickbro

 

Home access plus now doesn't show any folders or drive mappings, infact, it doesnt know who is an admin. I've logged in with my account and the domain admin account - both do not have the config tab.

 

Windows Network discovery

 

It would seem Windows Network Discovery doesn't work either when we type in NETWORK in the file explorer address bar.

 

------------------------------------------------------------

 

I've left the SMB1 client enabled on the servers to see if that had any affect to the above... it doesn't. I know the SMB1 client is working as we have a few NASs that only use SMB1. If i can connect to them via file explorer, SMB1 is working.

 

However, it seems that the MS patch has completed disabled the SMB1 protocol on machines. By this i mean i've done a bit of testing:

 

The entry SMB1 under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters is now set to 0. This is where the SMB1 protocol setting lives.

 

So i thought i'd set it back to 1 to see if any of the above worked and it appears it won't set back. It would seem that once the MS updates have been installed, there'is no going back.

 

I've tried the following:

 

- Setting SMB1 back to 1 via regedit. Restarted the machine and checked the entry. It's set back to 0.

 

- Setting SMB1 back to True via powershell running the command:

Set-SMBServerConfiguration -EnableSMB1protocol $true

. Restarted the machine and checked the entry & command via powershell. The entry has gone back to 0 and the value as gone back to FALSE

 

- Deleted SMB1 entry from HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters. Restarted the machine. The SMB1 entry comes back with a value of 0.

 

It would seem the only way to force this value back to 1 so that SMB1 is enabled on servers, is to force it via a reg hack in group policy however this opens up the security hole.

 

 

So for now the above services for us no longer work!

[nickbro]

My Home Access Plus install works fine with SMB1 disabled. I'm using 2008 r2, 2012 r2 and 2016 servers

[Arthur]

It would seem Windows Network Discovery doesn't work either when we type in NETWORK in the file explorer address bar.

That's normal.

 

https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-using-smb1/#div-comment-108875

[timbo343]

Oh! I might have to test a new instance of it tomorrow - thanks for coming back so quick.

[TwistedHelixis]

Lets hope Sims gets fixed fast. Its probably the office machines that we need to protect the most as they tend to get more dodgy emails then everyone else.

[nickbro]

I think it may be something to do with how you disabled SMB1. My SIMS is also working correctly. Check you are doing that registry setting, but also doing some other bits to allow workstation and browser to work.

[timbo343]

The way i've disable the SMB1 server is by the way MS have told us on this document (https://support.microsoft.com/en-us/help/2696547/how-to-enable-and-disable-smbv1-smbv2-and-smbv3-in-windows-and-windows-server) but what is interesting is the only information they have for Server 2012R2 is towards the end of the document titled (How to gracefully remove SMB v1 in Windows 8.1, Windows 10, Windows 2012 R2, and Windows Server 2016) which is actually the process to remove the SMB1 browser/client.. not the server.

 

I've found out that the updates from MS actually disable SMB1 as i mentioned in my first post so there's no point disabling the setting in the registry once the updates have been applied.

 

I'll do some digging on Network browser stopped working after disabling SMB1.

[synaesthesia]

Our SIMS did exactly the same for us with SMB disabled. It's amazing how complacent some companies are with using old technology to make things work, most notably in the printer/MFD world. Just about every engineer I've met from printer manufacturers set up SMB for shared scans etc as default despite the other commonly available options. Edited May 22, 2017 by synaesthesia

[timbo343]

My Home Access Plus install works fine with SMB1 disabled. I'm using 2008 r2, 2012 r2 and 2016 servers

 

Apologies about saying HAP doesn't work, it seems to be working now but im not sure what the issue was. I need to turn off one of the DCs, one that i plan to remove from the network soon - this DC was off over the weekend due to a hardware issue but there are 4 other DCs on our network. This DC which was off luckily doesnt have any FSMO roles on it - its just an aging DNS/AD server and an old CA server but ive got a new CA server setup now - not that we use it,

[Koldov]

Our SIMS did exactly the same for us with SMB disabled. It's amazing how complacent some companies are with using old technology to make things work, most notably in the printer/MFD world. Just about every engineer I've met from printer manufacturers set up SMB for shared scans etc as default despite the other commonly available options.

 

Our SIMS appears to be ok, but I don't actually have a machine to deploy to, just that they appear in the SOLUS 3 browser window.

 

I still see a list of networked computers in explorer too (actually I would be happier if I didn't, but never worked out how to stop it).

 

Having this discussion with our printer/MFD supplier's tech department at the moment. Since disabling SMB v.1 (gracefully) on our servers, we have no ability to scan into a shared folder.

 

The Ricoh that they assured me would work apparently doesn't use SMB v.1 directly, but uses SAMBA - which does....

 

They have also told me that scan to ftp isn't much more secure...

 

Now if I scan to email, do I have to set-up 30 or so email addresses on the MFD?

[jonnykewell1]

For anyone who uses FROG for home access to network drives, it breaks the connection through to the file servers where drives are stored.

[ChrisH]

You need to make sure the dependencies are set correctly on the server and workstation services, I disabled mine via power shell but ended up going back and running similar commands to the recommended ones for server 2008 R2 using the sc command even though it worked on all the other servers.

[timbo343]

You need to make sure the dependencies are set correctly on the server and workstation services, I disabled mine via power shell but ended up going back and running similar commands to the recommended ones for server 2008 R2 using the sc command even though it worked on all the other servers.

 

Surely the dependencies are only controlling the SMB1 client? The SC.exe commands disable the SMB1 client from starting on the machines.

 

I've set the dependencies on our HAP server as instructed via the registry and i cannot browse to the SMB1 share on our NAS boxes.

[ChrisH]

Surely the dependencies are only controlling the SMB1 client? The SC.exe commands disable the SMB1 client from starting on the machines.

 

I've set the dependencies on our HAP server as instructed via the registry and i cannot browse to the SMB1 share on our NAS boxes.

 

Sorry I was referring to my SIMS issues, my reply is a bit out of current context it was rushed!

Edited May 22, 2017 by ChrisH

[timbo343]

Sorry I was referring to my SIMS issues, my reply is a bit out of current context it was rushed!

 

No worries, im just curious to how others have their SIMS network & agent discovery working when the dependencies seem to be set as standard on our SIMS server.

 

 

 

 

The attached screen shots have the Mrxsmb10 START key set to 2 which means the SMB1 client is enabled but yet SIMS doesn't work as expected.

[TwistedHelixis]

The attached screen shots have the Mrxsmb10 START key set to 2 which means the SMB1 client is enabled but yet SIMS doesn't work as expected.

 

Going to be honest and say I dont really get how SMB1 /2 / 3 work but the first pics show smb2 as enabled , would they not need to be SMB1 for you to test Sims is working using SMB1.

[timbo343]

Going to be honest and say I dont really get how SMB1 /2 / 3 work but the first pics show smb2 as enabled , would they not need to be SMB1 for you to test Sims is working using SMB1.

 

that would be going against the update that MS gave out in March / April as those updates disable SMB1. The only way to test this would be to push out a group policy with a reg hack to the SIMS server to set the value to 1 but it leaves the system open to the wannacry worm.

[mavhc]

Doesn't the update fix the bug, not disable smb v1?

[timbo343]

Doesn't the update fix the bug, not disable smb v1?

 

I was thinking the fix was to disable SMB1 as i find it a coincidence that setting SMB1 back to 1 and then restart the server, the value changes back to 0 automatically. The only thing i can think of that the update is causing this value to change back to 0.

 

It seems suspicious that my machine used to be ok with Impero that has been affected in the same way since the round of updates. Before the updates were applied to the machines in school we could see the machines listed, now with the updates installed, we are having an issue.

[mavhc]

Which part of impero is not working?

 

BTW, Kyocera photocopies don't support smb v2 either, so lame. At this rate we'll end up with 1 smb v1 server that's firewalled to only accept connections from the photocopies, and then 1 way dfs replicate to the normal file server

[timbo343]

Which part of impero is not working?

 

BTW, Kyocera photocopies don't support smb v2 either, so lame. At this rate we'll end up with 1 smb v1 server that's firewalled to only accept connections from the photocopies, and then 1 way dfs replicate to the normal file server

 

The MSI deployment (see the first post of this thread), it's the same issue with the SIMS server when searching the network.

 

Our Toshiba MFDs also dont support SMB1 but we didnt use it, we used Scan to Email instead.

[mavhc]

Yeah, I guess that's the same as Network Browsing, smb1 only thing, you'll have to use Add Domain, at least it remembers everything but password, perhaps they can add something to cache the results.

[timbo343]

So, i've just tried a fresh install of WIndows LTSB2016 and SMB1 is enabled. Installed Impero and proceeded to deploy MSI. It turns out the machines are not listed so that rules out my theory.

 

As for adding the domain to the list, everytime we want to install an MSI, we have to input the details. As you say, you'd have thought Impero would have thought of this and have this set as default?

[Theldron]

Scan to file has stopped working on our Toshiba e-Studio MFPs and ABTutor remote deployment has stopped working since disabling SMB1.

[kidpressingbuttons]

Had my Kyocera mfds not working after we switched off smb1. Supplier was in next day and upgraded the firmware on all the copiers to support smb2. Worth checking with your provider!