Disable SMBv1 and Enforce SMB Signing via Group Policy

SMBv1 is a 40-year-old protocol with fundamental design flaws that cannot be patched away. It lacks encryption, lacks integrity protection worth trusting, and was the vector for EternalBlue — the exploit behind WannaCry and NotPetya. Microsoft has deprecated it since 2014, yet it still survives in many environments because of one old printer, scanner, or NAS device. Alongside removing SMBv1, enforcing SMB signing stops a different but equally dangerous class of attacks: NTLM relay.

Why both changes matter

• Removing SMBv1 eliminates exposure to remote code execution exploits and downgrade attacks that force a connection onto the weakest dialect.
• Enforcing SMB signing adds a cryptographic signature to every SMB packet. Without it, an attacker on the network can relay captured NTLM authentication to another machine and act as that user — a core technique in tools like ntlmrelayx and a standard step in most internal penetration tests.

Audit phase — do this first

• Enable SMBv1 auditing on file servers: Set-SmbServerConfiguration -AuditSmb1Access $true, then watch the Microsoft-Windows-SMBServer/Audit event log to see which clients still connect with SMBv1.
• Check whether SMBv1 is even installed: Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol on clients, Get-WindowsFeature FS-SMB1 on servers.
• Typical stragglers are multifunction printers doing scan-to-share, old NAS boxes, industrial equipment, and legacy applications. Upgrade firmware, replace the device, or isolate it in a segmented VLAN — do not keep SMBv1 enabled domain-wide for one device.

Enforcement via Group Policy

• Remove SMBv1 using a GPO that disables the SMB1Protocol optional feature, or push Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol through your management tooling. Windows 10 1709+ and Server 2019+ no longer install it by default.
• Enforce signing under Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options: set both Microsoft network server: Digitally sign communications (always) and Microsoft network client: Digitally sign communications (always) to Enabled.
• Apply server-side signing to domain controllers and file servers first, then extend the client-side requirement in a second wave.

Impact and verification

• SMB signing adds minor CPU overhead on very high-throughput file servers; on modern hardware with SMB3 this is rarely noticeable.
• Verify a session is signed with Get-SmbConnection | Format-List Dialect,Signed from a client.
• After enforcement, any device that cannot sign will fail to connect — which is exactly the point, but it is also why the audit phase is not optional.

This pairing is one of the highest-value, lowest-cost hardening steps available in a Windows domain: it removes a wormable protocol and neutralizes NTLM relay in a single change window.