question

TwiteJonathan-3329 avatar image
0 Votes"
TwiteJonathan-3329 asked SunnyQi-MSFT commented

Disabled SMBv1 (server) still got event 3000

Hello experts,

We would like to disable SMBv1 to prevent ransomware attack. We have run “Set-SmbServerConfiguration -enableSmb1Protocol $false -force” from server side but still found event 3000. We also run “disable-WindowsOptionalFeatue -online -FeatureName SMB1Protocol” but didn’t restart server. Does it need to restart server after running this command? Will ransomware attach the server if enabled SMBv1 from client side?

Thanks in advance.

windows-server-2016
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

SunnyQi-MSFT avatar image
0 Votes"
SunnyQi-MSFT answered SunnyQi-MSFT commented

Hi,

Thanks for posting in Q&A platform.

May I know if the content of Event 3000 is "This event indicates that a client attempted to access the server using SMB1." If yes, then this just indicates that there is a client tries to access the server via SMB1, if SMBv1 has been disabled from server side, then the server will not be affected by this.

We also run “disable-WindowsOptionalFeatue -online -FeatureName SMB1Protocol” but didn’t restart server. Does it need to restart server after running this command?

If you run this command from client side to disable SMBv1, it will need a reboot from client side.

Will ransomware attach the server if enabled SMBv1 from client side?

If the SMBv1 has been disabled from server side, then the client can only initiate the access request, but the server will not response this request, so the server will not be affected. However, Microsoft suggest you disable SMBv1 on both client and server side due to security consideration and support consideration. Always installing the latest patch should effectively help to prevent attacks.

Best Regards,
Sunny


If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Thank you Sunny! This answers my questions!

0 Votes 0 ·

You're welcome.

0 Votes 0 ·