Tuesday, 10 October 2017 12:49

Re-Enable SMBv1 in Windows 10 1709 Using MDT

Written by
Rate this item
(3 votes)

image

In case you have not heard, you should stop using SMB1. Not only is it 30 years old and was publicly deprecated back in 2014, it was also superseded by SMBv2 all the way back in 2007. In Windows 10, version 1709 (Fall Creators Update) and Windows Server, version 1709 (RS3), the Server Message Block version 1 (SMBv1) network protocol is no longer installed by default. The full removal has begun.

There is a caveat: while there are few valid use cases left in modern enterprises where SMB1 is still required, you may still be running a product that explicitly requires SMBv1. In my personal experience, an attempt to get rid of an outdated product, may hit a snag and the conversation with the CEO may go like this:

Security Officer: "Microsoft removed SMBv1 in the latest edition of Windows 10 because it is an older protocol and it has known security issues regarding ransomware and other malware."
CEO: "Is it possible to reinstall it?"
Security Officer: "Yes, but Microsoft strongly recommends that we do not reinstall it as SMBv1 was the main attack vector for the recent WannaCry outbreak."
CEO: "You do know I am the CEO, right?"

Case and point, SMBv1 is bad, really bad and you should never, ever reinstall it. But - if this is your only option - it is very easy to enable SMB1 in your environment during OSD. Simply add an Install Roles and Features step in your task sequence and select SMB 1.0/CIFS File Sharing Support feature.

Alternatively, run this simple PowerShell script:

# Determine where to do the logging 
$tsenv = New-Object -COMObject Microsoft.SMS.TSEnvironment 
$logPath = $tsenv.Value("LogPath")  
$logFile = "$logPath\$($myInvocation.MyCommand).log"

# Start the logging 
Start-Transcript $logFile
Write-Host "Logging to $logFile"

# Start Main Code Here

Write-Host "Enabling SMB1 optional feature."
Enable-WindowsOptionalFeature -Online -FeatureName smb1protocol -NoRestart

# Stop logging 
Stop-Transcript

EnableSMBv1.ps1

Read 34748 times Last modified on Tuesday, 10 October 2017 18:20
  1. Comments (5)

  2. Add yours
This comment was minimized by the moderator on the site

Hi Anton,

At which step do you suggest to add this on Task Sequence. Immediately after the OS install?

I added the step after under Post Install and received an error stating "The script should only run in the full OS......."

Manoj
This comment was minimized by the moderator on the site

Either move the step to the State Restore phase (e.g. FullOS) or change the command so that it is capable of servicing an offline OS. Something along these lines should do the trick:

Start-Process -FilePath "dism.exe" -ArgumentList...

Either move the step to the State Restore phase (e.g. FullOS) or change the command so that it is capable of servicing an offline OS. Something along these lines should do the trick:

Start-Process -FilePath "dism.exe" -ArgumentList "/Image:$($tsenv.Value("OSDisk")) /Enable-Feature /FeatureName:smb1protocol /NoRestart" -Wait

Read More
Anton Romanyuk
This comment was minimized by the moderator on the site

Hi,
I have a network problem after my latest Windows 10 update to 1903 - although my two computers see each other they cannot share their files. I discovered your older article and tried your script, but the operating system does not seem to like...

Hi,
I have a network problem after my latest Windows 10 update to 1903 - although my two computers see each other they cannot share their files. I discovered your older article and tried your script, but the operating system does not seem to like I . Here`s the dump of log file - could you kindly look at it? Thank you very much.
Best Regards
Swat


New-Object : Retrieving the COM class factory for component with CLSID {00000000-0000-0000-0000-000000000000} failed due to the following error: 80040154 Class not registered (Exception from HRESULT: 0x80040154 (REGDB_E_CLASSNOTREG)). At C:\EnableSMBv1.ps1:18 char:10 + $tsenv = New-Object -COMObject Microsoft.SMS.TSEnvironment + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ResourceUnavailable: (:) [New-Object], COMException
+ FullyQualifiedErrorId : NoCOMClassIdentified,Microsoft.PowerShell.Commands.NewObjectCommand

You cannot call a method on a null-valued expression.
At C:\EnableSMBv1.ps1:19 char:1
+ $logPath = $tsenv.Value("LogPath")
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidOperation: (:) [], RuntimeException
+ FullyQualifiedErrorId : InvokeMethodOnNull

Transcript started, output file is \EnableSMBv1.ps1.log
Logging to \EnableSMBv1.ps1.log
Enabling SMB1 optional feature.


Path :
Online : True
RestartNeeded : False

Transcript stopped, output file is C:\EnableSMBv1.ps1.log

Read More
Swat
This comment was minimized by the moderator on the site

Actually the script worked in your case. Running it outside of an MDT task sequence environment results in the SMS.TSEnvironment and log path variables not being populated, hence the error messages. The relevant bit is this one:

Path :
Online :...

Actually the script worked in your case. Running it outside of an MDT task sequence environment results in the SMS.TSEnvironment and log path variables not being populated, hence the error messages. The relevant bit is this one:

Path :
Online : True
RestartNeeded : False

Read More
Anton Romanyuk
This comment was minimized by the moderator on the site

Hi Swat... I have sam Problem with Windows 10 v1903.
Just ad Line to Powershell Script:
Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol-Client -All -NoRestart

now is SMB 1.0 (all) on and work well....

Miki
There are no comments posted here yet

Leave your comments

  1. Posting comment as a guest.
0 Characters
Attachments (0 / 3)
Share Your Location

Recent Posts