# Ensure 'Configure SMB v1 client driver' is set to 'Enabled: Disable driver (recommended)'

The Server Message Block version 1 (SMBv1) protocol is a legacy file sharing protocol with numerous, well-documented, and severe security vulnerabilities. Its flaws have been exploited by major ransomware attacks, including WannaCry and NotPetya, to propagate rapidly across networks. The protocol lacks modern security features such as pre-authentication integrity, strong encryption, and protection against man-in-the-middle attacks. Leaving the SMBv1 client enabled creates a significant attack surface, exposing the system to remote code execution and information disclosure risks. The audit script verifies the effective state of the SMBv1 client feature, while the remediation script disables this feature to mitigate the associated risks. All security baselines (Basic, Moderate, and Strict) recommend the 'Disabled' state. There is no secure configuration for SMBv1; its use is universally discouraged by security organizations and vendors, including Microsoft. Any system requiring SMBv1 for legacy compatibility should be isolated and have a clear migration plan to a modern, secure alternative.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that uses the `Get-WindowsOptionalFeature` cmdlet to check the state of the 'SMB1Protocol-Client' feature. The script must output only the value of the 'State' property (e.g., 'Enabled' or 'Disabled'), with no additional text or formatting.

## Remediation Script Working

PowerShell script that accepts a single positional argument: 'Enabled' or 'Disabled'. Based on the argument, the script must use either `Enable-WindowsOptionalFeature` or `Disable-WindowsOptionalFeature` for the 'SMB1Protocol-Client' feature. The script must include the `-Online` and `-NoRestart` parameters. It must return `$true` upon successful completion and `$false` if the operation fails or an invalid argument is provided.

