# Ensure 'Configure SMB v1 server' is set to 'Disabled'

Necessity: The Server Message Block version 1 (SMBv1) protocol is an obsolete and insecure network file-sharing protocol. It contains numerous critical vulnerabilities that have been exploited by major cyberattacks, including the WannaCry and NotPetya ransomware worms. Leaving the SMBv1 server enabled exposes the system to remote code execution and denial-of-service attacks, creating a significant security risk. All modern systems should use SMBv2 or a later version. Auditing and Remediation: The audit script verifies the current state of the 'SMB1Protocol-Server' Windows optional feature. The remediation script directly modifies this feature's state, either enabling or disabling it based on the provided input. A system restart may be required for the change to take full effect. Recommended State Rationale: The recommendation for all levels—Basic, Moderate, and Strict—is 'Disabled'. There is no secure configuration that involves enabling SMBv1. Basic: Disabling SMBv1 is the absolute minimum security baseline recommended by Microsoft and virtually all security frameworks. Moderate: There is no middle ground for security with this protocol; it must be disabled to be considered moderately secure. Strict: The strictest and only acceptable security posture is to have the protocol disabled. The risk associated with SMBv1 is so severe that its use is unjustifiable in any modern environment.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to check if the SMBv1 server feature is enabled. The script must query the status of the 'SMB1Protocol-Server' optional Windows feature and return only the string value of its 'State' property, such as 'Disabled' or 'Enabled'.

## Remediation Script Working

PowerShell script that accepts a single string argument ('Enabled' or 'Disabled') from the command line. The script must use this argument to set the state of the 'SMB1Protocol-Server' optional Windows feature using 'Enable-WindowsOptionalFeature' or 'Disable-WindowsOptionalFeature'. The script must return $true on successful completion or $false if the operation fails.

