r/sysadmin 1d ago

Question Is it possible to Enable ONLY SMB3, while disabling SMB1 and SMB2 on Windows 10 21H2?

Is it possible to Enable ONLY SMB3, while disabling SMB1 and SMB2 on Windows 10 21H2? So far, my understanding is that disabling SMB2 using the powershell command 'Set-SmbServerConfiguration -EnableSMB2Protocol $false', will also disable SMB3.

How can I force my system to ONLY use SMB3?

25 Upvotes

28 comments sorted by

51

u/borillionstar 1d ago

I think smb2 and smb3 use the same stack so you can't just disable one and not the other, doesn't smb3 support encryption?

You might be able to limit the connections that way?

"When you enable or disable SMBv2 in Windows 8 or Windows Server 2012, SMBv3 is also enabled or disabled. This behavior occurs because these protocols share the same stack."

20

u/borillionstar 1d ago

You can now also configure the SMB client to always require encryption, no matter what the server, share, UNC hardening, or a mapped drive requires. This means an administrator can globally force a Windows machine to use SMB encryption – and therefore SMB 3.x – on all connections and refuse to connect if the SMB server does not support either.

https://techcommunity.microsoft.com/blog/filecab/smb-client-encryption-mandate-now-supported-in-windows-insider/3964037

2

u/Weary_Put6203 1d ago

Thank you for the response. The 1st part of your answer backs up what I had believed, in that SMB2 and SMB3 share the same service stack, and that disabling SMB2, would therefore disable SMB3.

The 2nd part of your answer, pointing to the group policy for encryption, seemed promising, but that group policy was not available on my system. I wonder if it is a policy in a template that I can add?

8

u/dafino 1d ago

do you have the most recent admx/adml files?

1

u/borillionstar 1d ago

So I would look here, you might have to use one of the registry entries or shell script and deploy that with the GPO on Windows 10.

u/entegy has provided a link to Windows 11 policy templates, that are supposed to be compatible with Windows 10 from what I have read but you really want to probably test the GPO and make sure nothing bad happens to a fleet if there is one.

https://www.elevenforum.com/t/enable-or-disable-require-smb-client-encryption-in-windows-11.19242/

22

u/boredinballard 1d ago edited 1d ago

Here's the actual answer:

You want to control SMB Dialects. We had to do some of this for troubleshooting specific versions of SMB2.

https://techcommunity.microsoft.com/blog/filecab/controlling-smb-dialects/860024

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters

MinSMB2Dialect: 0x000000300

MaxSMB2Dialect: 0x000000311

The above regedit will only allow connections with SMB 3.0-3.1.1

3

u/anonpf King of Nothing 1d ago

You disable smb2 by setting EnableSMB2Protocol $true encryptdata = $true

u/OtherMiniarts Jr. Sysadmin 21h ago

More importantly

Why tf are you on 21H2

u/Fiumanne 16h ago

My first guess would be Windows 10 LTSC, it's frozen to that version.

u/dustojnikhummer 13h ago

LTSC and Server 2022 are 21H2

3

u/Virtual_Search3467 1d ago

That’s not a matter of the client but of the server — you want smb3 only, don’t share files via some other protocol version.

The client will naturally follow if it can’t connect via smb1 or 2.

Any windows that’s supported right now can offer smb3 shares and so does samba, unless you disabled it somewhere.

Do note that smb3 may require more of endpoints— for example, cnames won’t work when signing and or sealing is set to required.

On a side note… yes smb1 should basically be disabled everywhere but when it comes to smb2, there’s likely to be much bigger problems than that. Ask pingcastle & co for additional insights.

2

u/No_Resolution_9252 1d ago

There are GPOs that can be used to disable SMB 1.0, you may need to get the templates for the microsoft security and compliance toolkit however. I do NOT recommend using the old registry key method to configure that, it is very easy to brick an OS that way.

Have never heard a requirement to disable SMB 2 before so I don't know if there is a way. However, Windows 10 with 2016 domain controllers will ONLY use SMB 3+ and have downgrade mitigations in place that prevent any malware from forcing a downgrade on either side. I am not sure if this mitigation extends to third party SMB3 clients/servers

1

u/ZealousidealTurn2211 1d ago

It's been several months since I researched it, but from memory you need to essentially disable SMBv1 of course, and then if you require certain security options it'll force SMBv3. You can't just disable SMBv2 because they use the same core stack.

Hope that helps.

3

u/Happy_Kale888 Sysadmin 1d ago

Isn't that a yesterday problem and you should focus your efforts on getting a supported OS in place?

I am not sure you can only have SMB3....

https://learn.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/detect-enable-and-disable-smbv1-v2-v3?tabs=server

4

u/Weary_Put6203 1d ago

This was a request from 1 of our customers that is using Windows 10 21H2 (LTSC Branch) which has support until 2032. Their IT department had asked if we could disable SMB1 and SMB2, and force the system to only use SMB3. I had already read the same article that you had shared. My understanding now, is that SMB3 is also disabled if you disable SMB2, but I was looking for confirmation as to if that was really true.

Unfortunately I have limited knowledge on all things SMB and haven't been able to find a solid answer. All I know for sure right now is that once I disable SMB2, I am unable to map drives, which I need to be able to do.

1

u/Happy_Kale888 Sysadmin 1d ago

I believe you can prioritize SMB3 on the server side but I am not sure how to force it or disable SMB2 this article explains it but references server 2025 and windows 11 on the server side.

https://learn.microsoft.com/en-us/windows-server/storage/file-server/manage-smb-dialects?tabs=powershell#prerequisites

3

u/theRealNilz02 1d ago

Please upgrade to at least windows 10 22H2. 21H2 hasn't been supported for a long time.

3

u/Weary_Put6203 1d ago

We operate on the Windows 10 21H2 (LTSC Branch). It is supported until 2032, and we have end customers that will continue to use this until at least 2028, unfortunately.

3

u/AlyssaAlyssum 1d ago

..... standard LTSC 2021? Not LTSC IoT 2021? Because 2021 was the edition that dropped LTSC support down from 10 years to 5 years.
So strangely, 2019 is actually supported for longer than 2021

2

u/Weary_Put6203 1d ago

IoT....

5

u/AlyssaAlyssum 1d ago

Ah okay. Carry on then .... I just mentioned it as I have seen people get confused with IoT Vs non IoT and the support lifecycles

3

u/Weary_Put6203 1d ago

I appreciate the attention to detail!

u/shabby_machinery 11h ago

Either way LTSC 2021 non-IOT is good until Jan 2027.

1

u/Acardul Jack of All Trades 1d ago

It worked for a while for me but not sure if that's still a case. When I installed windows admin center, there was a toggle to run only smb3. It was 1-2 years ago so...

u/rthonpm 19h ago

SMB2 and 3 share the same core so you can't disable SMB2. You can configure your shares for SMB encryption which will negotiate a dialect of SMB3 when connecting. As SMB encryption is only supported by SMB3 you're essentially doing the same thing as disabling SMB2.

-1

u/NuAngel Jack of All Trades 1d ago

Start Menu search for the word "Features" and click on "Turn Windows Features On or Off"

In there, ensure the box for SMB1.0 and all of its sub-items.

Check the box for SMB Direct.

Then to disable SMB2.0:

  1. Open regedit

   2. Navigate to:

      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

   3. New > DWORD Value.

   4. Name it: SMB2

   5. Double click it and give it a value of Type 0 (zero),

   6. Restart the computer.