# Ensure 'Configure SMB v1 client driver' is set to 'Enabled: Disable driver (recommended)'

Necessity: The SMBv1 protocol is a deprecated and highly insecure file-sharing protocol. It contains critical vulnerabilities that were famously exploited by ransomware like WannaCry and NotPetya. Leaving the SMBv1 client driver enabled exposes the system to remote code execution and man-in-the-middle attacks, representing a severe security risk. Disabling it is a fundamental step in hardening modern Windows systems. Auditing and Remediation: The audit script verifies the system's configuration by checking the 'Start' value of the 'mrxsmb10' service in the Windows Registry. A value of '4' confirms the driver is disabled. The remediation script directly modifies this registry value to '4', which is the required setting to disable the service driver and mitigate the associated vulnerabilities. Recommended State Rationale: The recommendation for Basic, Moderate, and Strict levels is uniformly '4' (Disabled). There is no secure configuration for SMBv1. The protocol's flaws are inherent, and any state other than disabled presents an unacceptable security risk. This aligns with universal guidance from Microsoft and security benchmarks like CIS, which mandate its complete removal or disabling. Therefore, the only acceptable state, regardless of the desired security posture, is to ensure the driver is disabled.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['4']` |
| **Moderate** | `['4']` |
| **Strict** | `['4']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the 'Start' registry value for the 'mrxsmb10' service located at 'HKLM:\SYSTEM\CurrentControlSet\Services\mrxsmb10'. The script should output only the numerical data of the 'Start' value. If the value does not exist, the script should output 'Not Found'.

## Remediation Script Working

PowerShell script that accepts a single numerical command-line argument representing the desired start type. The script must set the 'Start' registry value (as a REG_DWORD) for the 'mrxsmb10' service at 'HKLM:\SYSTEM\CurrentControlSet\Services\mrxsmb10' to the provided argument. The script must return `$true` on successful modification and `$false` on failure.

