# Ensure 'Configure SMB v1 server' is set to 'Disabled'

Necessity: The Server Message Block version 1 (SMBv1) protocol is a legacy networking protocol with numerous publicly known and severe vulnerabilities. It was notably exploited by ransomware worms like WannaCry and NotPetya. Leaving SMBv1 enabled exposes the system to remote code execution, denial of service, and man-in-the-middle attacks, as it lacks modern security features like pre-authentication integrity and encryption. The risk of compromise from this outdated protocol is exceptionally high. Auditing and Remediation: The audit script queries the Windows Optional Features to determine if the SMBv1 server component is installed and active. The remediation script directly addresses this by using PowerShell cmdlets to uninstall and disable the feature, thereby closing the associated attack vectors. Recommended State Rationale: The recommendation is consistently 'Disabled' across all security levels (Basic, Moderate, and Strict). This is because there is no secure configuration for SMBv1 on a modern network. Microsoft and all major cybersecurity frameworks strongly advise its complete removal. The Basic state reflects this fundamental requirement. The Moderate and Strict states reinforce this position, as any level of security hardening mandates the removal of this deprecated and dangerous protocol. There is no acceptable use case for SMBv1 that outweighs its inherent security risks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to check the status of the SMBv1 server feature. The script must use the `Get-WindowsOptionalFeature` cmdlet for the feature name 'SMB1Protocol-Server' and output only the value of the 'State' property (e.g., 'Disabled' or 'Enabled'), with no extra text or labels.

## Remediation Script Working

PowerShell script that accepts a single positional string argument ('Enabled' or 'Disabled'). The script must use this argument to either enable or disable the 'SMB1Protocol-Server' feature using the appropriate cmdlet (`Enable-WindowsOptionalFeature` or `Disable-WindowsOptionalFeature`) with the `-Online` and `-NoRestart` parameters. The script must return `$true` upon successful completion or `$false` if it fails.

