SMB Mystery

[Gongalong]

Hi folks,

 

I've spotted that SMBv1 is enabled on our SIMS server. If I disable it, I can no longer map a drive to it, and cannot deploy SIMS. SMBv2 is enabled, according to the PowerShell command here https://support.microsoft.com/en-gb/help/2696547/how-to-detect-enable-and-disable-smbv1-smbv2-and-smbv3-in-windows-and

 

Any ideas as to why PCs won't talk to the server if SMBv1 is disabled? Do clients have to have SMBv1 disabled to use SMBv2?

 

Thanks

[Gongalong]

I just tested, and with both SMBv1 disabled on the client (Win 10) and the server (2012 R2) I can't browse file shares or RDP. Odd!

 

Was mostly thinking to disable SMBv1 for virus reasons.

[3s-gtech]

Very odd. When I disabled SMBv1 on clients and servers, SIMS and mapped drives/share browsing weren't affected. Do you have Windows firewall getting in the way? Have you re-traced your way through the necessary steps to make sure everything has been switched on for SMBv2/3 support?

[Gongalong]

Firewall's off in the domain. Are there extra steps over and above just the straight switch off of v1? Oddly no other server seems affected, just our SIMS server.

[Arthur]

I just tested, and with both SMBv1 disabled on the client (Win 10) and the server (2012 R2) I can't browse file shares or RDP. Odd!

Did you reboot after disabling?

[Gongalong]

Yes. (Extra text because I can't comment with less than 6 characters )

[3s-gtech]

Yes I think there are other steps, including registry changes.

[Gongalong]

There's mention of registry changes in the above Microsoft article, but that only seems to be if you want to make the change via registry rather than features or PowerShell.

[3s-gtech]

Have you made the client and server changes on the server? There were issues when this first did the rounds of people disabling the SMBv1 client protocol on the server, but leaving the SMBv1 server protocol enabled. I did that! Worth checking against the registry changes anyway, to double check that the correct settings are in place.

[Arthur]

Firewall's off in the domain.

Did you do this by stopping the firewall service? If so, that's why you won't be able to RDP or connect to servers.

 

https://community.spiceworks.com/topic/1954425-server-2012-windows-firewall-service-disabled-remotely

[Gongalong]

With 2012 R2, I disabled the feature. Is that the server or client protocol, and how would I do the other bit? Still using this as my reference, but nothing's leaping out at me in terms of server or client https://support.microsoft.com/en-gb/help/2696547/how-to-detect-enable-and-disable-smbv1-smbv2-and-smbv3-in-windows-and

[Gongalong]

Did you do this by stopping the firewall service?

No. Just the domain bit is turned off, via GP.

[Gongalong]

Finally had time to revisit the problem. I did change a few bits of registry, so can't guarantee it was just this, but this was definitely part of it:

 

HKLM\System\CurrentControlSet\Services\LanmanServer. DependsOnService. Ensured this was set to SamSS Srv2, not SamSS Srv.

HKLM\System\CurrentControlSet\Services\LanmanWorkstation. DependsOnService. Ensured this was set to bowser mrxsmb20 nsi, not bowser mrxsmb10 mrxsmb20 nsi, or bowser mrxsmb10 nsi

 

Now working in that I can browse the server and deploy SIMS.