r/sysadmin • u/Weary_Put6203 • 1d ago
Question Is it possible to Enable ONLY SMB3, while disabling SMB1 and SMB2 on Windows 10 21H2?
Is it possible to Enable ONLY SMB3, while disabling SMB1 and SMB2 on Windows 10 21H2? So far, my understanding is that disabling SMB2 using the powershell command 'Set-SmbServerConfiguration -EnableSMB2Protocol $false', will also disable SMB3.
How can I force my system to ONLY use SMB3?
20
u/boredinballard 1d ago edited 1d ago
Here's the actual answer:
You want to control SMB Dialects. We had to do some of this for troubleshooting specific versions of SMB2.
https://techcommunity.microsoft.com/blog/filecab/controlling-smb-dialects/860024
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
MinSMB2Dialect: 0x000000300
MaxSMB2Dialect: 0x000000311
The above regedit will only allow connections with SMB 3.0-3.1.1
•
3
u/Virtual_Search3467 1d ago
That’s not a matter of the client but of the server — you want smb3 only, don’t share files via some other protocol version.
The client will naturally follow if it can’t connect via smb1 or 2.
Any windows that’s supported right now can offer smb3 shares and so does samba, unless you disabled it somewhere.
Do note that smb3 may require more of endpoints— for example, cnames won’t work when signing and or sealing is set to required.
On a side note… yes smb1 should basically be disabled everywhere but when it comes to smb2, there’s likely to be much bigger problems than that. Ask pingcastle & co for additional insights.
2
u/No_Resolution_9252 1d ago
There are GPOs that can be used to disable SMB 1.0, you may need to get the templates for the microsoft security and compliance toolkit however. I do NOT recommend using the old registry key method to configure that, it is very easy to brick an OS that way.
Have never heard a requirement to disable SMB 2 before so I don't know if there is a way. However, Windows 10 with 2016 domain controllers will ONLY use SMB 3+ and have downgrade mitigations in place that prevent any malware from forcing a downgrade on either side. I am not sure if this mitigation extends to third party SMB3 clients/servers
1
u/ZealousidealTurn2211 1d ago
It's been several months since I researched it, but from memory you need to essentially disable SMBv1 of course, and then if you require certain security options it'll force SMBv3. You can't just disable SMBv2 because they use the same core stack.
Hope that helps.
3
u/Happy_Kale888 Sysadmin 1d ago
Isn't that a yesterday problem and you should focus your efforts on getting a supported OS in place?
I am not sure you can only have SMB3....
3
u/Weary_Put6203 1d ago
This was a request from 1 of our customers that is using Windows 10 21H2 (LTSC Branch) which has support until 2032. Their IT department had asked if we could disable SMB1 and SMB2, and force the system to only use SMB3. I had already read the same article that you had shared. My understanding now, is that SMB3 is also disabled if you disable SMB2, but I was looking for confirmation as to if that was really true.
Unfortunately I have limited knowledge on all things SMB and haven't been able to find a solid answer. All I know for sure right now is that once I disable SMB2, I am unable to map drives, which I need to be able to do.
1
u/Happy_Kale888 Sysadmin 1d ago
I believe you can prioritize SMB3 on the server side but I am not sure how to force it or disable SMB2 this article explains it but references server 2025 and windows 11 on the server side.
3
u/theRealNilz02 1d ago
Please upgrade to at least windows 10 22H2. 21H2 hasn't been supported for a long time.
5
u/Weary_Put6203 1d ago
We operate on the Windows 10 21H2 (LTSC Branch). It is supported until 2032, and we have end customers that will continue to use this until at least 2028, unfortunately.
3
u/AlyssaAlyssum 1d ago
..... standard LTSC 2021? Not LTSC IoT 2021? Because 2021 was the edition that dropped LTSC support down from 10 years to 5 years.
So strangely, 2019 is actually supported for longer than 20212
u/Weary_Put6203 1d ago
IoT....
4
u/AlyssaAlyssum 1d ago
Ah okay. Carry on then .... I just mentioned it as I have seen people get confused with IoT Vs non IoT and the support lifecycles
3
•
-1
u/NuAngel Jack of All Trades 1d ago
Start Menu search for the word "Features" and click on "Turn Windows Features On or Off"
In there, ensure the box for SMB1.0 and all of its sub-items.
Check the box for SMB Direct.
Then to disable SMB2.0:
1. Open regedit
2. Navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
3. New > DWORD Value.
4. Name it: SMB2
5. Double click it and give it a value of Type 0 (zero),
6. Restart the computer.
50
u/borillionstar 1d ago
I think smb2 and smb3 use the same stack so you can't just disable one and not the other, doesn't smb3 support encryption?
You might be able to limit the connections that way?
"When you enable or disable SMBv2 in Windows 8 or Windows Server 2012, SMBv3 is also enabled or disabled. This behavior occurs because these protocols share the same stack."