Things that don't work after SMB1 is disabled

[forkies]

We have disabled smb1 and apart from network browsing which we don't use anyway, the copiers use Papercut scanning which still works, and nothing else seems to be not working (fingers crossed).

 

So as long as you can live without network browsing (and have papercut for scanning) seems ok?

[mavhc]

Had my Kyocera mfds not working after we switched off smb1. Supplier was in next day and upgraded the firmware on all the copiers to support smb2. Worth checking with your provider!

 

It was our provider who told us they didn't have an update, lame.

 

Got a version number so I can slap them with it?

[kidpressingbuttons]

uh not sure on firmware versions but Kyocera have been releasing them this week. We use Kyocera 3551's if that helps

[3s-gtech]

Spoke to Konica Minolta yesterday. They said that our 758s will work with SMB v2 if they're on software version 2.1 or above. We had an engineer out to firmware upgrade it to 2.2 and it's working. Our 654 doesn't work - they said that firmware is being written. Their software support are good - they're aware of the problem and have been plugging away at it.

[Theldron]

Doesn't the update fix the bug, not disable smb v1?

 

If you have applied the update, do you need to disable SMB1?

 

Just wondering as disabling SMB1 is giving me headaches, but if I have to I would rather disable it than be open to threats.

[timbo343]

If you have applied the update, do you need to disable SMB1?

 

Just wondering as disabling SMB1 is giving me headaches, but if I have to I would rather disable it than be open to threats.

Ive found that the March/April updates does disable SMB1 server on machines.

[witch]

Scan to file has stopped working on our Toshiba e-Studio MFPs since disabling SMB1.

 

Same here. Although our other Toshiba copier still scans to file fine

[Theldron]

Same here. Although our other Toshiba copier still works fine

 

Iv'e found that the 263's have stopped working but the 2040's are still working.

[mavhc]

If you have applied the update, do you need to disable SMB1?

 

Just wondering as disabling SMB1 is giving me headaches, but if I have to I would rather disable it than be open to threats.

 

Need? No. Probably should because there's likely to be more bugs, plus forcing smb2 or higher gives you faster and more secure connections? Yes.

[ollyyllo]

Spoke to our MFP provider, they say Kyocera are working on a firmware update for SMBv2, models 4551ci and 3051ci

[timbo343]

IMPERO - @Mic_Impero

 

The deployment of the MSI no longer sees machines on the network via the network browser (see screenshot):

 

[ATTACH=CONFIG]43326[/ATTACH]

 

Only my machine is listed, before all machines that were found on the network used to be there.

 

 

After speaking to Impero Yesterday, it would seem this is now the correct way to push out an MSI. We now have to input the details into the Add Domain window every time we want to push out an MSI via Impero.

Edited May 25, 2017 by timbo343

[RichCowell]

IMPERO - @Mic_Impero

 

The deployment of the MSI no longer sees machines on the network via the network browser (see screenshot):

 

[ATTACH=CONFIG]43326[/ATTACH]

 

Only my machine is listed, before all machines that were found on the network used to be there.

 

After speaking to Impero Yesterday, it would seem this is now the correct way to push out an MSI. We now have to input the details into the Add Domain window every time we want to push out an MSI via Impero.

 

Which version are you using? I've just re-enabled SMB on my PC and the Impero server and the Deploy MSI list is populated as normal again... (Using 6.0.76)

[timbo343]

 

Which version are you using? I've just re-enabled SMB on my PC and the Impero server and the Deploy MSI list is populated as normal again... (Using 6.0.76)

We are on 6.0.79.

 

 

When you say SMB you mean the SMB1 server or the SMB client?

 

I guess ive been told some duff information by impero [emoji35] .

Edited May 25, 2017 by timbo343

[RichCowell]

We are on 6.0.79.

 

When you say SMB you mean the SMB1 server or the SMB client?

 

I guess ive been told some duff information by impero [emoji35] .

 

Just the client I'd disabled over the weekend -

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB1 -Type DWORD -Value 1 -Force

 

I'd not asked them about it, I'd just assumed that's why it stopped, so enabled it again after I saw your post just to see if it worked again and it was fine... maybe they're assuming people will leave SMB disabled?

[timbo343]

 

Just the client I'd disabled over the weekend -

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB1 -Type DWORD -Value 1 -Force

 

I'd not asked them about it, I'd just assumed that's why it stopped, so enabled it again after I saw your post just to see if it worked again and it was fine... maybe they're assuming people will leave SMB disabled?

 

 

I think that's the server that you disabled, see "lanmanServer" in the path. The client is listed under "LanmanWorkstation".

 

I might have to test this to see what happens - the only issue is, since deploying the updates, the SMB1 server reg entry listed at HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters is set to revert back to 0 after a restart, the only way to set this back to 1 is to push out a Group Policy to set the value to 1.

[RichCowell]

I think that's the server that you disabled, see "lanmanServer" in the path. The client is listed under "LanmanWorkstation".

 

I might have to test this to see what happens - the only issue is, since deploying the updates, the SMB1 server reg entry listed at HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters is set to revert back to 0 after a restart, the only way to set this back to 1 is to push out a Group Policy to set the value to 1.

 

Indeed, just testing, honest! which updates set the reg entry to change back to 0? I rebooted after re-enabling it and it was still set to 1

[timbo343]

Indeed, just testing, honest! which updates set the reg entry to change back to 0? I rebooted after re-enabling it and it was still set to 1

 

Im not sure which update automatically changes the SMB1 Server entry to 0, i just know my servers are patched up to date and if i try setting this entry back to 1, after a restart the entry changes back to 0.

 

How it's now set:

 

 

Made the change:

 

 

After a restart:

 

 

I can also confirm that on our Impero Server, setting the SMB1 to 1 doesn't change how the deploy MSI works, however we are 6.0.79, not 6.0.76 but it's strange how version 5.4.38 on a fresh copy of LTSB2016 with no updates applied doesnt show the machines as standard.

Edited May 25, 2017 by timbo343

[caffrey]

Just had a call from our copier supplier and their software that is installed on our server isn't talking back (Printaudit) to them, stopped working the day I turned off SMB1 so not sure if it's that but it's a mighty fine coincidence.

[pete]

Konica Minolta C3350 and C284e series won't scan to SMB shares with SMB1 disabled.

 

Newer models (C308 replaces the C284e) work fine.

Edited May 25, 2017 by pete

[southhamster]

Konica Minolta C3350 and C284e series won't scan to SMB shares with SMB1 disabled.

 

Newer models (C308 replaces the C284e) work fine.

Been speaking to Konica about this and sounds like a firmware update is on it's way.

[pete]

Been speaking to Konica about this and sounds like a firmware update is on it's way.

 

Same - I spoke to Konica East IT and they asked me to raise it with our account manager. So I sent him a feature request that he's passed up the chain.

[Big_Ted]

We have disabled smb1 and apart from network browsing which we don't use anyway, the copiers use Papercut scanning which still works, and nothing else seems to be not working (fingers crossed).

 

So as long as you can live without network browsing (and have papercut for scanning) seems ok?

 

If you use integrated scanning the files are moved to the papercut server via https

if you use the copiers own scanning function it will use what ever it uses

[caffrey]

https://blogs.technet.microsoft.com/filecab/2017/06/01/smb1-product-clearinghouse/

[E_G_R2]

Getting Random Drive mapping issues, a re boot usually does the job but its really p**s*ng off the natives.

[pete]

@southhamster

 

Have you heard from KM on any progress? It's all gone silent on their end here.

 

I submitted the C3350 and C284e to the "Still needs SMB1" email address and got a response, but MS need a published KB article or customer documentation from KM that describes the affected models before they can publish. I can't find anything on their websites.