Uninstalling and Downgrading SMB 2.x

We’ve been extolling the virtues of SMB 2.x for the past few posts, but sometimes you may want to disable SMB entirely, or perhaps downgrade it from 2.x to 1.x. Here are some suggestions to point you in the right direction. I’ve tried them and they seem to work as advertised, but as always, try these on a test system before going live, and always back up the Registry before making any changes to it. You can uninstall the SMB service by navigating to the properties for the network connection and uninstalling both Client for Microsoft Networks and File and Printer Sharing for Microsoft Networks. You might consider this step, for example on a Web server or a DNS server; these systems don’t generally need SMB. If you don’t want to go as far an uninstalling the protocol, there are various ways to disable SMB. One fairly quick method is to block TCP ports 139 and 445. You can also disable SMB in Server 2003 by setting the Registry key SMBDeviceEnabled to 0 (DWORD type) under HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters. In Server 2008 systems acting as an SMB server, you can downgrade SMB by creating a DWORD value named “Smb2” under HKLM\CurrentControlSet\Services\LanmanServer\Parameters, and setting it to 0 to disable it. (You can re-enable it by setting the value to 1.) Now if you don’t already see a value in the same key named Smb1, create it, and set it to 1. This will enable SMB 1 on the server. If you want to disable server-side SMB completely, set both the Smb2 and Smb1 values to 0. According to Microsoft, on Vista and Server 2008 systems that are acting as SMB clients, you can disable SMB 2 with these two commands: sc config lanmanworkstation depend= bowser/mrxsmb10/nsi sc config mrxsmb20 start= disabled You can undo the change later with these two commands: sc config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi sc config mrxsmb20 start= auto If you’re curious, mrxsmb10 is the SMB 1.x “mini-redirector,” mrxsmb20 is the SMB 2.x mini-redirector, and nsi stands for Network Store Interface service.