Disable Outdated Protocols: SMBv1, NetBIOS, LLMNR

Legacy network protocols, while once essential, now represent significant security vulnerabilities in modern environments. SMBv1, NetBIOS, and LLMNR are…

Legacy network protocols, while once essential, now represent significant security vulnerabilities in modern environments. SMBv1, NetBIOS, and LLMNR are prime examples of protocols designed for earlier, less adversarial network landscapes. Their continued presence provides attack surfaces for various exploits, including data interception, credential relay attacks, and malware propagation (e.g., WannaCry, NotPetya). This article details the processes for systematically disabling these outdated protocols across Windows server and client operating systems, focusing on both individual host configurations and domain-wide Group Policy Object (GPO) deployments.

Implementing these changes is a critical step in hardening network security, reducing the attack surface, and aligning systems with current best practices. While the immediate security benefits are clear, careful planning and testing are necessary to avoid disrupting legitimate services that might still rely on these protocols, particularly in older or specialized applications.

Disabling Server Message Block Version 1 (SMBv1)

SMBv1 is an archaic file-sharing protocol notorious for its security weaknesses. Microsoft officially deprecated it in Windows 10 and Windows Server 2012 R2, and it's disabled by default in newer versions (Windows 10 1709+, Windows Server 2019+). For older installations or systems where it was manually re-enabled, removal is imperative.

Checking SMBv1 Status

Before disabling, verify if SMBv1 is installed and running. This can be done via PowerShell:

Get-WindowsFeature FS-SMB1 # For Windows Server
Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol # For Windows Client OS

If State shows Enabled for SMB1Protocol or Installed for FS-SMB1, then it's active.

Disabling SMBv1 on Individual Systems

Windows Server (2012 R2 and newer)

Use Server Manager or PowerShell:

  • Server Manager: Remove Roles and Features Wizard > File and Storage Services > File Server > SMB 1.0/CIFS File Sharing Support. Uncheck and proceed.
  • PowerShell:
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -Remove
# A reboot may be required. To suppress reboot prompt (not recommended for production without testing):
# Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -Remove -NoRestart

Windows Client OS (Windows 8.1, 10, 11)

Use "Turn Windows features on or off" or PowerShell:

  • GUI: Control Panel > Programs > Turn Windows features on or off. Uncheck "SMB 1.0/CIFS File Sharing Support".
  • PowerShell:
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -Remove -NoRestart

A restart is often required after disabling SMBv1. Ensure no critical applications or devices (e.g., older network-attached storage, embedded systems, legacy print devices) rely solely on SMBv1 before proceeding in production environments.

Disabling SMBv1 via Group Policy (Domain-wide)

For domain-joined machines, GPO is the most efficient method. This requires a Windows Server 2012 R2 or newer Domain Controller with the latest ADMX templates.

  1. Open Group Policy Management Editor.
  2. Create a new GPO or edit an existing one linked to the OUs containing target computers.
  3. Navigate to: Computer Configuration > Policies > Administrative Templates > Network > Lanman Workstation.
  4. Enable the setting "Enable insecure guest logons" and set it to "Disabled". (While not directly disabling SMBv1, this prevents insecure guest access often associated with SMBv1 shares).
  5. To explicitly disable SMBv1 client and server components:
    • For Windows 8.1/Server 2012 R2 and later, there isn't a direct GPO setting to uninstall SMBv1. The recommended approach is to use a GPO to run a PowerShell script at startup.
    • Create a PowerShell script (e.g., Disable-SMBv1.ps1) with the content: 
      # Check if SMB1Protocol is installed
if (Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol | Where-Object {$_.State -eq "Enabled"}) {
    Write-Output "SMBv1 found and enabled. Attempting to disable..."
    Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -Remove -NoRestart
    # Log the action (optional)
    Add-Content -Path "C:\Windows\Temp\SMBv1_disable.log" -Value "$(Get-Date) - SMBv1 disabled on $($env:COMPUTERNAME)"
} else {
    Write-Output "SMBv1 not found or already disabled."
}
    • Link this script via GPO: Computer Configuration > Policies > Windows Settings > Scripts (Startup/Shutdown) > Startup. Add the PowerShell script.

Alternatively, a GPO-deployed Scheduled Task can execute the PowerShell script periodically or at startup.

Disabling NetBIOS over TCP/IP (NBT)

NetBIOS over TCP/IP (NBT) is a legacy naming and networking protocol primarily used for local network discovery and name resolution in older Windows environments. It lacks security features and is susceptible to various attacks, including name spoofing and information disclosure. Modern networks rely on DNS for name resolution and often employ Active Directory for service discovery, making NetBIOS largely redundant.

Checking NetBIOS Status

You can check the NetBIOS name cache and adapter settings:

nbtstat -n # Displays local NetBIOS names
ipconfig /all # Shows adapter-specific NetBIOS settings

Disabling NetBIOS on Individual Systems

NetBIOS over TCP/IP is configured per network adapter:

  1. Open Network Connections (ncpa.cpl).
  2. Right-click on a network adapter and select "Properties".
  3. Select "Internet Protocol Version 4 (TCP/IPv4)" and click "Properties".
  4. Click "Advanced...".
  5. Go to the "WINS" tab.
  6. Select "Disable NetBIOS over TCP/IP".
  7. Click "OK" on all open windows.

Repeat for all relevant network adapters. For DHCP-configured adapters, the setting "Use NetBIOS setting from the DHCP server" is usually the default. If your DHCP server is not configured to disable NetBIOS, it will remain active. See the GPO section for DHCP options.

Disabling NetBIOS via Group Policy (Domain-wide)

While there isn't a direct GPO setting for "Disable NetBIOS over TCP/IP," it can be controlled via DHCP options or a registry-based GPO.

Via DHCP Server Options

The most common and effective way to disable NetBIOS for DHCP clients is through DHCP server options.

  1. Open DHCP Management Console.
  2. Navigate to the relevant IPv4 scope.
  3. Right-click "Scope Options" and select "Configure Options...".
  4. Scroll down and select "043 NetBIOS over TCP/IP Name Server" and "046 NetBIOS over TCP/IP NBT node type".
  5. Set "043 NetBIOS over TCP/IP Name Server" to blank (no WINS servers).
  6. Set "046 NetBIOS over TCP/IP NBT node type" to 8 (for 0x8 or "h-node" which uses DNS for primary resolution, falling back to broadcast/WINS, but a blank WINS server option essentially disables it). For a more aggressive approach, some administrators set it to 2 (p-node, WINS only) with no WINS servers, effectively disabling NetBIOS name resolution, but this can cause issues if WINS was previously used.
  7. A more direct approach is to not configure DHCP Option 001 (Router) to include NetBIOS-related settings and ensure DHCP clients receive no WINS server addresses.

For statically configured systems, manual configuration or a registry GPO is required.

Registry-based GPO

This method forces the "Disable NetBIOS over TCP/IP" setting on each adapter that has a static IP configuration or for cases where DHCP options aren't fully trusted.

  1. Create a new GPO.
  2. Navigate to: Computer Configuration > Preferences > Registry.
  3. Create a new Registry Item.
  4. Action: Update
  5. Hive: HKEY_LOCAL_MACHINE
  6. Key Path: SYSTEM\CurrentControlSet\Services\NetBT\Parameters\Interfaces
  7. This key contains subkeys for each network interface. You cannot use wildcards here directly for specific adapters. Instead, you'll need to target specific interface GUIDs or use a GPO logon script or scheduled task to enumerate interfaces and set the value. A more general approach is often preferred.
  8. A more common registry setting affects the global behavior (though interface-specific settings override it). The registry value for disabling NetBIOS is typically NetbiosOptions under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters.
  9. Value Name: NetbiosOptions
  10. Value Type: REG_DWORD
  11. Value Data: 2 (0 = Use NetBIOS setting from the DHCP server, 1 = Enable NetBIOS over TCP/IP, 2 = Disable NetBIOS over TCP/IP)

Setting NetbiosOptions to 2 aims to disable NetBIOS for statically configured interfaces and override DHCP settings. This requires a restart to take full effect.

Disabling Link-Local Multicast Name Resolution (LLMNR)

LLMNR is a protocol based on DNS packet format that allows hosts to perform name resolution for hosts on the same local link without a DNS server. While useful in small peer-to-peer networks, it's susceptible to "spoofing" attacks where an attacker can impersonate a target machine, intercept traffic, or capture credentials (e.g., Responder.py attacks).

Checking LLMNR Status

LLMNR is enabled by default on Windows client and server operating systems. Its activity can be observed with network packet analyzers like Wireshark.

Disabling LLMNR on Individual Systems

The easiest way to disable LLMNR is through the Local Group Policy Editor (gpedit.msc) or the registry.

  1. Open gpedit.msc.
  2. Navigate to: Computer Configuration > Administrative Templates > Network > DNS Client.
  3. Find the setting "Turn off multicast name resolution".
  4. Double-click it, select "Enabled", and click "OK". (Note: "Enabled" in this context means "Enabled the turning off of LLMNR").

A reboot is usually not required, but network services may need to be restarted for full effect.

Disabling LLMNR via Group Policy (Domain-wide)

This is the recommended method for domain-joined machines:

  1. Open Group Policy Management Editor.
  2. Create a new GPO or edit an existing one linked to the OUs containing target computers.
  3. Navigate to: Computer Configuration > Policies > Administrative Templates > Network > DNS Client.
  4. Double-click the setting "Turn off multicast name resolution".
  5. Select "Enabled" and click "Apply", then "OK".
  6. Force a GPO update on client machines (gpupdate /force) or wait for the next refresh cycle.

Common Pitfalls and Troubleshooting

  • Application Compatibility: Older applications, NAS devices, or embedded systems (e.g., surveillance cameras, legacy printers) may explicitly rely on SMBv1, NetBIOS, or LLMNR for file sharing, name resolution, or device discovery. Always test changes in a representative staging environment before deploying to production.
  • Network Share Access Issues: If SMBv1 is disabled, clients attempting to connect to shares using only SMBv1 will fail. Ensure all clients and servers support SMBv2 or SMBv3.
  • Name Resolution Failures: Disabling NetBIOS or LLMNR can lead to issues resolving hostnames on the local subnet if DNS is not properly configured or if systems rely solely on broadcast-based name resolution. Verify DNS infrastructure is robust and reliable.
  • GPO Application Issues: Ensure GPOs are correctly linked, enforced, and applied to the target OUs. Use gpresult /r and gpupdate /force on clients to verify policy application. Check the Event Viewer for GPO processing errors.
  • Restart Requirements: While some changes take effect immediately, a system restart is often required for complete removal or deactivation of these protocols, especially for SMBv1.
  • DHCP Configuration: If using DHCP to control NetBIOS, ensure all scopes are updated and clients renew their leases (e.g., ipconfig /release, ipconfig /renew).

Back to the knowledge base · Ask the AI assistant