[{"data":1,"prerenderedAt":2605},["ShallowReactive",2],{"post:\u002F2025\u002F11\u002F26\u002Fpowershell-windows-server-disable-smbv1-fleet-wide-and-verify-it-stuck\u002F":3},{"post":4,"newer":2557,"older":2567,"related":2576,"series":2603},{"id":5,"title":6,"body":7,"canonical":2539,"categories":2540,"date":2543,"description":2544,"extension":2545,"featured":2546,"hero":2547,"image":2547,"meta":2548,"navigation":762,"path":2549,"readingTime":481,"seo":2550,"series":2547,"seriesOrder":2547,"sites":2551,"source":2547,"stem":2552,"tags":2553,"updated":2547,"url":2555,"__hash__":2556},"blog\u002Fblog\u002F2025\u002F11\u002F26\u002Fpowershell-windows-server-disable-smbv1-fleet-wide-and-verify-it-stuck.md","PowerShell: Windows Server – Disable SMBv1 Fleet-Wide and Verify",{"type":8,"value":9,"toc":2531},"minimark",[10,19,24,59,63,214,223,227,230,263,266,294,297,374,377,398,401,440,443,451,455,2365,2369,2487,2491,2527],[11,12,13,14,18],"p",{},"SMBv1 isn't installed by default on Windows Server 2019 and later, but \"not installed by default\" and \"not installed anywhere\" are two different statements once you have a server fleet with years of in-place upgrades behind it. Microsoft's position is blunt: SMBv1 \"has significant security vulnerabilities, and we strongly encourage you not to use it,\" and if something still needs it, update that thing rather than reinstall SMBv1. Disabling it is one of the highest-value changes you can make, as long as you first find out who's still using it. This script does all three steps against a list of servers: it turns on SMBv1 access auditing and counts the audit events, it disables the SMBv1 server and the ",[15,16,17],"code",{},"SMB1Protocol"," optional feature, and because disabling the feature only finishes at restart, it reports which servers are clean, which are pending a restart, and which failed.",[20,21,23],"h2",{"id":22},"requirements","Requirements",[25,26,27,31,49,52],"ul",{},[28,29,30],"li",{},"Windows PowerShell 5.1 or later on the admin workstation, with PowerShell remoting (WinRM) reachable on every target.",[28,32,33,34,36,37,40,41,44,45,48],{},"Windows Server 2012 R2 or later on the targets. That's where the ",[15,35,17],{}," optional feature and the ",[15,38,39],{},"SmbShare"," cmdlets (",[15,42,43],{},"Get-SmbServerConfiguration",", ",[15,46,47],{},"Set-SmbServerConfiguration",") exist. Server 2008 R2 uses a registry value instead (see Notes).",[28,50,51],{},"Local administrator rights on each target.",[28,53,54,55,58],{},"Time. Run the ",[15,56,57],{},"-Audit"," pass and leave it for long enough to cover month-end jobs, backups and scanners before you run the disable pass.",[20,60,62],{"id":61},"parameters","Parameters",[64,65,66,85],"table",{},[67,68,69],"thead",{},[70,71,72,76,79,82],"tr",{},[73,74,75],"th",{},"Name",[73,77,78],{},"Type",[73,80,81],{},"Required",[73,83,84],{},"Description",[86,87,88,112,125,143,157,180,197],"tbody",{},[70,89,90,96,102,105],{},[91,92,93],"td",{},[15,94,95],{},"-ComputerName",[91,97,98,99],{},"String",[100,101],"span",{},[91,103,104],{},"No",[91,106,107,108,111],{},"Servers to process. If omitted, ",[15,109,110],{},"-ComputerListPath"," is used.",[70,113,114,118,120,122],{},[91,115,116],{},[15,117,110],{},[91,119,98],{},[91,121,104],{},[91,123,124],{},"Text file with one server name per line.",[70,126,127,131,134,136],{},[91,128,129],{},[15,130,57],{},[91,132,133],{},"Switch",[91,135,104],{},[91,137,138,139,142],{},"Turns on ",[15,140,141],{},"AuditSmb1Access"," and reports current state and event 3000 counts. Changes nothing else.",[70,144,145,150,152,154],{},[91,146,147],{},[15,148,149],{},"-Verify",[91,151,133],{},[91,153,104],{},[91,155,156],{},"Reports current state and event 3000 counts only. Changes nothing.",[70,158,159,164,167,169],{},[91,160,161],{},[15,162,163],{},"-AuditDays",[91,165,166],{},"Int",[91,168,104],{},[91,170,171,172,175,176,179],{},"How many days of ",[15,173,174],{},"Microsoft-Windows-SMBServer\u002FAudit"," events to count. Default ",[15,177,178],{},"14",".",[70,181,182,187,189,191],{},[91,183,184],{},[15,185,186],{},"-OutputPath",[91,188,98],{},[91,190,104],{},[91,192,193,194,179],{},"CSV of per-server results. Default ",[15,195,196],{},".\\smbv1-status.csv",[70,198,199,204,206,208],{},[91,200,201],{},[15,202,203],{},"-ThrottleLimit",[91,205,166],{},[91,207,104],{},[91,209,210,211,179],{},"Maximum concurrent remote connections. Default ",[15,212,213],{},"16",[11,215,216,217,219,220,222],{},"With neither ",[15,218,57],{}," nor ",[15,221,149],{},", the script disables SMBv1.",[20,224,226],{"id":225},"usage","Usage",[11,228,229],{},"Turn on auditing across the fleet and see where SMBv1 is still installed:",[231,232,237],"pre",{"className":233,"code":234,"language":235,"meta":236,"style":236},"language-powershell shiki shiki-themes github-dark",".\\Disable-Smb1Fleetwide.ps1 -ComputerListPath C:\\Lists\\servers.txt -Audit\n","powershell","",[15,238,239],{"__ignoreMap":236},[100,240,243,246,250,254,257,260],{"class":241,"line":242},"line",1,[100,244,179],{"class":245},"s95oV",[100,247,249],{"class":248},"sDLfK","\\Disable-Smb1Fleetwide.ps1",[100,251,253],{"class":252},"snl16"," -",[100,255,256],{"class":245},"ComputerListPath C:\\Lists\\servers.txt ",[100,258,259],{"class":252},"-",[100,261,262],{"class":245},"Audit\n",[11,264,265],{},"A couple of weeks later, check who has been connecting with SMBv1 (event ID 3000):",[231,267,269],{"className":233,"code":268,"language":235,"meta":236,"style":236},".\\Disable-Smb1Fleetwide.ps1 -ComputerListPath C:\\Lists\\servers.txt -Verify -AuditDays 30\n",[15,270,271],{"__ignoreMap":236},[100,272,273,275,277,279,281,283,286,288,291],{"class":241,"line":242},[100,274,179],{"class":245},[100,276,249],{"class":248},[100,278,253],{"class":252},[100,280,256],{"class":245},[100,282,259],{"class":252},[100,284,285],{"class":245},"Verify ",[100,287,259],{"class":252},[100,289,290],{"class":245},"AuditDays ",[100,292,293],{"class":248},"30\n",[11,295,296],{},"Look at the actual clients on a server that logged events before you break them:",[231,298,300],{"className":233,"code":299,"language":235,"meta":236,"style":236},"Get-WinEvent -ComputerName SRV-FILE01 -FilterHashtable @{ LogName = \"Microsoft-Windows-SMBServer\u002FAudit\"; Id = 3000 } -MaxEvents 20 |\n    Format-List -Property TimeCreated, Message\n",[15,301,302,357],{"__ignoreMap":236},[100,303,304,307,309,312,314,317,319,322,325,328,331,335,338,340,343,346,348,351,354],{"class":241,"line":242},[100,305,306],{"class":248},"Get-WinEvent",[100,308,253],{"class":252},[100,310,311],{"class":245},"ComputerName SRV",[100,313,259],{"class":252},[100,315,316],{"class":245},"FILE01 ",[100,318,259],{"class":252},[100,320,321],{"class":245},"FilterHashtable ",[100,323,324],{"class":252},"@",[100,326,327],{"class":245},"{ LogName ",[100,329,330],{"class":252},"=",[100,332,334],{"class":333},"sU2Wk"," \"Microsoft-Windows-SMBServer\u002FAudit\"",[100,336,337],{"class":245},"; Id ",[100,339,330],{"class":252},[100,341,342],{"class":248}," 3000",[100,344,345],{"class":245}," } ",[100,347,259],{"class":252},[100,349,350],{"class":245},"MaxEvents ",[100,352,353],{"class":248},"20",[100,355,356],{"class":252}," |\n",[100,358,360,363,365,368,371],{"class":241,"line":359},2,[100,361,362],{"class":248},"    Format-List",[100,364,253],{"class":252},[100,366,367],{"class":245},"Property TimeCreated",[100,369,370],{"class":252},",",[100,372,373],{"class":245}," Message\n",[11,375,376],{},"Disable SMBv1 on the servers that came back clean, then see which need a restart:",[231,378,380],{"className":233,"code":379,"language":235,"meta":236,"style":236},".\\Disable-Smb1Fleetwide.ps1 -ComputerListPath C:\\Lists\\servers-clean.txt\n",[15,381,382],{"__ignoreMap":236},[100,383,384,386,388,390,393,395],{"class":241,"line":242},[100,385,179],{"class":245},[100,387,249],{"class":248},[100,389,253],{"class":252},[100,391,392],{"class":245},"ComputerListPath C:\\Lists\\servers",[100,394,259],{"class":252},[100,396,397],{"class":245},"clean.txt\n",[11,399,400],{},"Re-run in verify mode after the maintenance window's restarts to confirm it stuck:",[231,402,404],{"className":233,"code":403,"language":235,"meta":236,"style":236},".\\Disable-Smb1Fleetwide.ps1 -ComputerListPath C:\\Lists\\servers-clean.txt -Verify -OutputPath C:\\Reports\\smbv1-post-restart.csv\n",[15,405,406],{"__ignoreMap":236},[100,407,408,410,412,414,416,418,421,423,425,427,430,432,435,437],{"class":241,"line":242},[100,409,179],{"class":245},[100,411,249],{"class":248},[100,413,253],{"class":252},[100,415,392],{"class":245},[100,417,259],{"class":252},[100,419,420],{"class":245},"clean.txt ",[100,422,259],{"class":252},[100,424,285],{"class":245},[100,426,259],{"class":252},[100,428,429],{"class":245},"OutputPath C:\\Reports\\smbv1",[100,431,259],{"class":252},[100,433,434],{"class":245},"post",[100,436,259],{"class":252},[100,438,439],{"class":245},"restart.csv\n",[11,441,442],{},"Sample console output from a disable run:",[231,444,449],{"className":445,"code":447,"language":448,"meta":236},[446],"language-text","Processing 3 server(s), throttle limit 16, mode Disable ...\nSRV-FILE01: disabled, restart pending (feature DisablePending, server SMB1 off)\nSRV-FILE02: already disabled, nothing to do\nWARNING: Unreachable: SRV-PRINT03 - WinRM cannot complete the operation. Verify that the specified computer name is valid, that the computer is accessible over the network, and that a firewall exception for the WinRM service is enabled and allows access from this computer.\nResults written to .\\smbv1-status.csv\n","text",[15,450,447],{"__ignoreMap":236},[20,452,454],{"id":453},"script","Script",[231,456,458],{"className":233,"code":457,"language":235,"meta":236,"style":236},"\u003C#\n.SYNOPSIS\n    Audits, disables and verifies SMBv1 across a list of Windows servers.\n.DESCRIPTION\n    For each target server, reads the SMB1Protocol optional feature state, the\n    SMB server's EnableSMB1Protocol and AuditSmb1Access settings, and the number\n    of event ID 3000 entries (SMBv1 client access) in the\n    Microsoft-Windows-SMBServer\u002FAudit log. -Audit also turns auditing on.\n    Without -Audit or -Verify, the script turns off the SMBv1 server\n    (Set-SmbServerConfiguration, takes effect without a restart), disables the\n    SMB1Protocol feature with -NoRestart, re-reads the feature state and records\n    whether a restart is pending. Results go to the console and a CSV.\n.PARAMETER ComputerName\n    One or more servers to process.\n.PARAMETER ComputerListPath\n    Text file with one server name per line, used when -ComputerName is not supplied.\n.PARAMETER Audit\n    Turns on AuditSmb1Access and reports state. Makes no other change.\n.PARAMETER Verify\n    Reports state only. Makes no changes.\n.PARAMETER AuditDays\n    Days of SMBServer\u002FAudit events to count. Default 14.\n.PARAMETER OutputPath\n    CSV of per-server results. Default .\\smbv1-status.csv.\n.PARAMETER ThrottleLimit\n    Maximum concurrent remote connections. Default 16.\n.EXAMPLE\n    .\\Disable-Smb1Fleetwide.ps1 -ComputerListPath C:\\Lists\\servers.txt -Audit\n.EXAMPLE\n    .\\Disable-Smb1Fleetwide.ps1 -ComputerListPath C:\\Lists\\servers.txt\n.NOTES\n    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n    Version : 1.0 (2025-11-26)\n    Requires: PowerShell remoting on targets; Windows Server 2012 R2 or later; local admin\n.LINK\n    https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fstorage\u002Ffile-server\u002Ftroubleshoot\u002Fdetect-enable-and-disable-smbv1-v2-v3\n#>\n[CmdletBinding()]\nparam (\n    [string[]]$ComputerName,\n\n    [string]$ComputerListPath,\n\n    [switch]$Audit,\n\n    [switch]$Verify,\n\n    [ValidateRange(1, 365)]\n    [int]$AuditDays = 14,\n\n    [string]$OutputPath = \".\\smbv1-status.csv\",\n\n    [int]$ThrottleLimit = 16\n)\n\nif ($Audit -and $Verify) {\n    throw \"Use -Audit or -Verify, not both.\"\n}\n\nif (-not $ComputerName) {\n    if (-not $ComputerListPath -or -not (Test-Path -Path $ComputerListPath)) {\n        throw \"Supply -ComputerName or a valid -ComputerListPath.\"\n    }\n\n    $ComputerName = Get-Content -Path $ComputerListPath | Where-Object { $_.Trim() -ne \"\" }\n}\n\n$mode = if ($Audit) { \"Audit\" } elseif ($Verify) { \"Verify\" } else { \"Disable\" }\n\nWrite-Host \"Processing $(@($ComputerName).Count) server(s), throttle limit $ThrottleLimit, mode $mode ...\"\n\n# Runs on each remote server. Mode and AuditDays arrive through -ArgumentList.\n$smb1Script = {\n    param ($Mode, $AuditDays)\n\n    $result = [ordered]@{\n        StartingFeature    = $null\n        EndingFeature      = $null\n        ServerSmb1Enabled  = $null\n        AuditEnabled       = $null\n        Smb1AccessEvents   = $null\n        Action             = \"none\"\n        RestartNeeded      = $false\n        Error              = $null\n    }\n\n    try {\n        $feature = Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -ErrorAction Stop\n        $result.StartingFeature = [string]$feature.State\n\n        if ($Mode -eq \"Audit\") {\n            Set-SmbServerConfiguration -AuditSmb1Access $true -Force -ErrorAction Stop\n            $result.Action = \"audit enabled\"\n        }\n\n        if ($Mode -eq \"Disable\") {\n            # Server side first: takes effect immediately, no restart needed.\n            if ((Get-SmbServerConfiguration).EnableSMB1Protocol) {\n                Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force -ErrorAction Stop\n                $result.Action = \"server SMB1 off\"\n            }\n\n            # Then disable the feature (SMBv1 client and server). Finishes at restart.\n            if ($feature.State -ne \"Disabled\") {\n                $image = Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart -ErrorAction Stop\n                $result.RestartNeeded = [bool]$image.RestartNeeded\n                $result.Action = \"disabled\"\n            }\n        }\n\n        $config = Get-SmbServerConfiguration\n        $result.ServerSmb1Enabled = $config.EnableSMB1Protocol\n        $result.AuditEnabled = $config.AuditSmb1Access\n        $result.EndingFeature = [string](Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol).State\n\n        $filter = @{\n            LogName   = \"Microsoft-Windows-SMBServer\u002FAudit\"\n            Id        = 3000\n            StartTime = (Get-Date).AddDays(-$AuditDays)\n        }\n        $result.Smb1AccessEvents = @(Get-WinEvent -FilterHashtable $filter -ErrorAction SilentlyContinue).Count\n    } catch {\n        $result.Action = \"failed\"\n        $result.Error = $_.Exception.Message\n    }\n\n    [PSCustomObject]$result\n}\n\n$invokeParams = @{\n    ComputerName  = $ComputerName\n    ScriptBlock   = $smb1Script\n    ArgumentList  = $mode, $AuditDays\n    ThrottleLimit = $ThrottleLimit\n    ErrorAction   = \"SilentlyContinue\"\n    ErrorVariable = \"remoteErrors\"\n}\n\n$results = Invoke-Command @invokeParams\n\nforeach ($result in ($results | Sort-Object -Property PSComputerName)) {\n    $target = $result.PSComputerName\n\n    if ($result.Error) {\n        Write-Host \"$target`: failed - $($result.Error)\"\n    } elseif ($result.Action -eq \"disabled\") {\n        $state = if ($result.RestartNeeded) { \"restart pending\" } else { \"no restart needed\" }\n        Write-Host \"$target`: disabled, $state (feature $($result.EndingFeature), server SMB1 $(if ($result.ServerSmb1Enabled) { 'on' } else { 'off' }))\"\n    } elseif ($result.EndingFeature -eq \"Disabled\" -and -not $result.ServerSmb1Enabled) {\n        Write-Host \"$target`: already disabled, nothing to do\"\n    } else {\n        Write-Host \"$target`: SMBv1 feature $($result.EndingFeature), server SMB1 enabled $($result.ServerSmb1Enabled), audit $($result.AuditEnabled), $($result.Smb1AccessEvents) access event(s) in $AuditDays days\"\n    }\n}\n\n$results |\n    Select-Object -Property PSComputerName, StartingFeature, EndingFeature, ServerSmb1Enabled, AuditEnabled, Smb1AccessEvents, Action, RestartNeeded, Error |\n    Export-Csv -Path $OutputPath -NoTypeInformation\n\nforeach ($failure in $remoteErrors) {\n    Write-Warning \"Unreachable: $($failure.TargetObject) - $($failure.Exception.Message)\"\n}\n\nWrite-Host \"Results written to $OutputPath\"\n",[15,459,460,466,473,479,487,493,499,505,511,517,523,529,535,546,552,562,568,578,584,594,600,610,616,626,632,642,648,656,662,669,675,683,689,695,701,709,715,721,733,742,757,764,776,781,794,799,811,816,838,856,861,878,883,898,904,909,924,933,939,944,958,987,996,1002,1007,1047,1052,1057,1097,1102,1141,1146,1152,1163,1177,1182,1204,1215,1225,1235,1245,1255,1266,1277,1287,1292,1297,1305,1331,1346,1351,1369,1392,1403,1409,1414,1428,1434,1448,1470,1481,1487,1492,1498,1513,1541,1557,1567,1572,1577,1582,1593,1604,1615,1642,1647,1660,1671,1682,1703,1708,1732,1743,1754,1768,1773,1778,1789,1794,1799,1811,1822,1833,1849,1860,1871,1882,1887,1892,1906,1911,1936,1947,1952,1960,1988,2005,2032,2094,2116,2128,2137,2200,2205,2210,2215,2223,2276,2292,2297,2310,2342,2347,2352],{"__ignoreMap":236},[100,461,462],{"class":241,"line":242},[100,463,465],{"class":464},"sAwPA","\u003C#\n",[100,467,468,470],{"class":241,"line":359},[100,469,179],{"class":248},[100,471,472],{"class":252},"SYNOPSIS\n",[100,474,476],{"class":241,"line":475},3,[100,477,478],{"class":464},"    Audits, disables and verifies SMBv1 across a list of Windows servers.\n",[100,480,482,484],{"class":241,"line":481},4,[100,483,179],{"class":248},[100,485,486],{"class":252},"DESCRIPTION\n",[100,488,490],{"class":241,"line":489},5,[100,491,492],{"class":464},"    For each target server, reads the SMB1Protocol optional feature state, the\n",[100,494,496],{"class":241,"line":495},6,[100,497,498],{"class":464},"    SMB server's EnableSMB1Protocol and AuditSmb1Access settings, and the number\n",[100,500,502],{"class":241,"line":501},7,[100,503,504],{"class":464},"    of event ID 3000 entries (SMBv1 client access) in the\n",[100,506,508],{"class":241,"line":507},8,[100,509,510],{"class":464},"    Microsoft-Windows-SMBServer\u002FAudit log. -Audit also turns auditing on.\n",[100,512,514],{"class":241,"line":513},9,[100,515,516],{"class":464},"    Without -Audit or -Verify, the script turns off the SMBv1 server\n",[100,518,520],{"class":241,"line":519},10,[100,521,522],{"class":464},"    (Set-SmbServerConfiguration, takes effect without a restart), disables the\n",[100,524,526],{"class":241,"line":525},11,[100,527,528],{"class":464},"    SMB1Protocol feature with -NoRestart, re-reads the feature state and records\n",[100,530,532],{"class":241,"line":531},12,[100,533,534],{"class":464},"    whether a restart is pending. Results go to the console and a CSV.\n",[100,536,538,540,543],{"class":241,"line":537},13,[100,539,179],{"class":248},[100,541,542],{"class":252},"PARAMETER",[100,544,545],{"class":252}," ComputerName\n",[100,547,549],{"class":241,"line":548},14,[100,550,551],{"class":464},"    One or more servers to process.\n",[100,553,555,557,559],{"class":241,"line":554},15,[100,556,179],{"class":248},[100,558,542],{"class":252},[100,560,561],{"class":252}," ComputerListPath\n",[100,563,565],{"class":241,"line":564},16,[100,566,567],{"class":464},"    Text file with one server name per line, used when -ComputerName is not supplied.\n",[100,569,571,573,575],{"class":241,"line":570},17,[100,572,179],{"class":248},[100,574,542],{"class":252},[100,576,577],{"class":252}," Audit\n",[100,579,581],{"class":241,"line":580},18,[100,582,583],{"class":464},"    Turns on AuditSmb1Access and reports state. Makes no other change.\n",[100,585,587,589,591],{"class":241,"line":586},19,[100,588,179],{"class":248},[100,590,542],{"class":252},[100,592,593],{"class":252}," Verify\n",[100,595,597],{"class":241,"line":596},20,[100,598,599],{"class":464},"    Reports state only. Makes no changes.\n",[100,601,603,605,607],{"class":241,"line":602},21,[100,604,179],{"class":248},[100,606,542],{"class":252},[100,608,609],{"class":252}," AuditDays\n",[100,611,613],{"class":241,"line":612},22,[100,614,615],{"class":464},"    Days of SMBServer\u002FAudit events to count. Default 14.\n",[100,617,619,621,623],{"class":241,"line":618},23,[100,620,179],{"class":248},[100,622,542],{"class":252},[100,624,625],{"class":252}," OutputPath\n",[100,627,629],{"class":241,"line":628},24,[100,630,631],{"class":464},"    CSV of per-server results. Default .\\smbv1-status.csv.\n",[100,633,635,637,639],{"class":241,"line":634},25,[100,636,179],{"class":248},[100,638,542],{"class":252},[100,640,641],{"class":252}," ThrottleLimit\n",[100,643,645],{"class":241,"line":644},26,[100,646,647],{"class":464},"    Maximum concurrent remote connections. Default 16.\n",[100,649,651,653],{"class":241,"line":650},27,[100,652,179],{"class":248},[100,654,655],{"class":252},"EXAMPLE\n",[100,657,659],{"class":241,"line":658},28,[100,660,661],{"class":464},"    .\\Disable-Smb1Fleetwide.ps1 -ComputerListPath C:\\Lists\\servers.txt -Audit\n",[100,663,665,667],{"class":241,"line":664},29,[100,666,179],{"class":248},[100,668,655],{"class":252},[100,670,672],{"class":241,"line":671},30,[100,673,674],{"class":464},"    .\\Disable-Smb1Fleetwide.ps1 -ComputerListPath C:\\Lists\\servers.txt\n",[100,676,678,680],{"class":241,"line":677},31,[100,679,179],{"class":248},[100,681,682],{"class":252},"NOTES\n",[100,684,686],{"class":241,"line":685},32,[100,687,688],{"class":464},"    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n",[100,690,692],{"class":241,"line":691},33,[100,693,694],{"class":464},"    Version : 1.0 (2025-11-26)\n",[100,696,698],{"class":241,"line":697},34,[100,699,700],{"class":464},"    Requires: PowerShell remoting on targets; Windows Server 2012 R2 or later; local admin\n",[100,702,704,706],{"class":241,"line":703},35,[100,705,179],{"class":248},[100,707,708],{"class":252},"LINK\n",[100,710,712],{"class":241,"line":711},36,[100,713,714],{"class":464},"    https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fstorage\u002Ffile-server\u002Ftroubleshoot\u002Fdetect-enable-and-disable-smbv1-v2-v3\n",[100,716,718],{"class":241,"line":717},37,[100,719,720],{"class":464},"#>\n",[100,722,724,727,730],{"class":241,"line":723},38,[100,725,726],{"class":245},"[",[100,728,729],{"class":248},"CmdletBinding",[100,731,732],{"class":245},"()]\n",[100,734,736,739],{"class":241,"line":735},39,[100,737,738],{"class":252},"param",[100,740,741],{"class":245}," (\n",[100,743,745,748,751,754],{"class":241,"line":744},40,[100,746,747],{"class":245},"    [",[100,749,750],{"class":252},"string",[100,752,753],{"class":245},"[]]$ComputerName",[100,755,756],{"class":252},",\n",[100,758,760],{"class":241,"line":759},41,[100,761,763],{"emptyLinePlaceholder":762},true,"\n",[100,765,767,769,771,774],{"class":241,"line":766},42,[100,768,747],{"class":245},[100,770,750],{"class":252},[100,772,773],{"class":245},"]$ComputerListPath",[100,775,756],{"class":252},[100,777,779],{"class":241,"line":778},43,[100,780,763],{"emptyLinePlaceholder":762},[100,782,784,786,789,792],{"class":241,"line":783},44,[100,785,747],{"class":245},[100,787,788],{"class":252},"switch",[100,790,791],{"class":245},"]$Audit",[100,793,756],{"class":252},[100,795,797],{"class":241,"line":796},45,[100,798,763],{"emptyLinePlaceholder":762},[100,800,802,804,806,809],{"class":241,"line":801},46,[100,803,747],{"class":245},[100,805,788],{"class":252},[100,807,808],{"class":245},"]$Verify",[100,810,756],{"class":252},[100,812,814],{"class":241,"line":813},47,[100,815,763],{"emptyLinePlaceholder":762},[100,817,819,821,824,827,830,832,835],{"class":241,"line":818},48,[100,820,747],{"class":245},[100,822,823],{"class":248},"ValidateRange",[100,825,826],{"class":245},"(",[100,828,829],{"class":248},"1",[100,831,370],{"class":252},[100,833,834],{"class":248}," 365",[100,836,837],{"class":245},")]\n",[100,839,841,843,846,849,851,854],{"class":241,"line":840},49,[100,842,747],{"class":245},[100,844,845],{"class":252},"int",[100,847,848],{"class":245},"]$AuditDays ",[100,850,330],{"class":252},[100,852,853],{"class":248}," 14",[100,855,756],{"class":252},[100,857,859],{"class":241,"line":858},50,[100,860,763],{"emptyLinePlaceholder":762},[100,862,864,866,868,871,873,876],{"class":241,"line":863},51,[100,865,747],{"class":245},[100,867,750],{"class":252},[100,869,870],{"class":245},"]$OutputPath ",[100,872,330],{"class":252},[100,874,875],{"class":333}," \".\\smbv1-status.csv\"",[100,877,756],{"class":252},[100,879,881],{"class":241,"line":880},52,[100,882,763],{"emptyLinePlaceholder":762},[100,884,886,888,890,893,895],{"class":241,"line":885},53,[100,887,747],{"class":245},[100,889,845],{"class":252},[100,891,892],{"class":245},"]$ThrottleLimit ",[100,894,330],{"class":252},[100,896,897],{"class":248}," 16\n",[100,899,901],{"class":241,"line":900},54,[100,902,903],{"class":245},")\n",[100,905,907],{"class":241,"line":906},55,[100,908,763],{"emptyLinePlaceholder":762},[100,910,912,915,918,921],{"class":241,"line":911},56,[100,913,914],{"class":252},"if",[100,916,917],{"class":245}," ($Audit ",[100,919,920],{"class":252},"-and",[100,922,923],{"class":245}," $Verify) {\n",[100,925,927,930],{"class":241,"line":926},57,[100,928,929],{"class":252},"    throw",[100,931,932],{"class":333}," \"Use -Audit or -Verify, not both.\"\n",[100,934,936],{"class":241,"line":935},58,[100,937,938],{"class":245},"}\n",[100,940,942],{"class":241,"line":941},59,[100,943,763],{"emptyLinePlaceholder":762},[100,945,947,949,952,955],{"class":241,"line":946},60,[100,948,914],{"class":252},[100,950,951],{"class":245}," (",[100,953,954],{"class":252},"-not",[100,956,957],{"class":245}," $ComputerName) {\n",[100,959,961,964,966,968,971,974,977,979,982,984],{"class":241,"line":960},61,[100,962,963],{"class":252},"    if",[100,965,951],{"class":245},[100,967,954],{"class":252},[100,969,970],{"class":245}," $ComputerListPath ",[100,972,973],{"class":252},"-or",[100,975,976],{"class":252}," -not",[100,978,951],{"class":245},[100,980,981],{"class":248},"Test-Path",[100,983,253],{"class":252},[100,985,986],{"class":245},"Path $ComputerListPath)) {\n",[100,988,990,993],{"class":241,"line":989},62,[100,991,992],{"class":252},"        throw",[100,994,995],{"class":333}," \"Supply -ComputerName or a valid -ComputerListPath.\"\n",[100,997,999],{"class":241,"line":998},63,[100,1000,1001],{"class":245},"    }\n",[100,1003,1005],{"class":241,"line":1004},64,[100,1006,763],{"emptyLinePlaceholder":762},[100,1008,1010,1013,1015,1018,1020,1023,1026,1029,1032,1035,1038,1041,1044],{"class":241,"line":1009},65,[100,1011,1012],{"class":245},"    $ComputerName ",[100,1014,330],{"class":252},[100,1016,1017],{"class":248}," Get-Content",[100,1019,253],{"class":252},[100,1021,1022],{"class":245},"Path $ComputerListPath ",[100,1024,1025],{"class":252},"|",[100,1027,1028],{"class":248}," Where-Object",[100,1030,1031],{"class":245}," { ",[100,1033,1034],{"class":248},"$_",[100,1036,1037],{"class":245},".Trim() ",[100,1039,1040],{"class":252},"-ne",[100,1042,1043],{"class":333}," \"\"",[100,1045,1046],{"class":245}," }\n",[100,1048,1050],{"class":241,"line":1049},66,[100,1051,938],{"class":245},[100,1053,1055],{"class":241,"line":1054},67,[100,1056,763],{"emptyLinePlaceholder":762},[100,1058,1060,1063,1065,1068,1071,1074,1076,1079,1082,1085,1087,1090,1092,1095],{"class":241,"line":1059},68,[100,1061,1062],{"class":245},"$mode ",[100,1064,330],{"class":252},[100,1066,1067],{"class":252}," if",[100,1069,1070],{"class":245}," ($Audit) { ",[100,1072,1073],{"class":333},"\"Audit\"",[100,1075,345],{"class":245},[100,1077,1078],{"class":252},"elseif",[100,1080,1081],{"class":245}," ($Verify) { ",[100,1083,1084],{"class":333},"\"Verify\"",[100,1086,345],{"class":245},[100,1088,1089],{"class":252},"else",[100,1091,1031],{"class":245},[100,1093,1094],{"class":333},"\"Disable\"",[100,1096,1046],{"class":245},[100,1098,1100],{"class":241,"line":1099},69,[100,1101,763],{"emptyLinePlaceholder":762},[100,1103,1105,1108,1111,1114,1116,1118,1120,1123,1126,1129,1132,1135,1138],{"class":241,"line":1104},70,[100,1106,1107],{"class":248},"Write-Host",[100,1109,1110],{"class":333}," \"Processing ",[100,1112,1113],{"class":252},"$",[100,1115,826],{"class":333},[100,1117,324],{"class":252},[100,1119,826],{"class":333},[100,1121,1122],{"class":245},"$ComputerName",[100,1124,1125],{"class":333},").Count)",[100,1127,1128],{"class":333}," server(s), throttle limit ",[100,1130,1131],{"class":245},"$ThrottleLimit",[100,1133,1134],{"class":333},", mode ",[100,1136,1137],{"class":245},"$mode",[100,1139,1140],{"class":333}," ...\"\n",[100,1142,1144],{"class":241,"line":1143},71,[100,1145,763],{"emptyLinePlaceholder":762},[100,1147,1149],{"class":241,"line":1148},72,[100,1150,1151],{"class":464},"# Runs on each remote server. Mode and AuditDays arrive through -ArgumentList.\n",[100,1153,1155,1158,1160],{"class":241,"line":1154},73,[100,1156,1157],{"class":245},"$smb1Script ",[100,1159,330],{"class":252},[100,1161,1162],{"class":245}," {\n",[100,1164,1166,1169,1172,1174],{"class":241,"line":1165},74,[100,1167,1168],{"class":252},"    param",[100,1170,1171],{"class":245}," ($Mode",[100,1173,370],{"class":252},[100,1175,1176],{"class":245}," $AuditDays)\n",[100,1178,1180],{"class":241,"line":1179},75,[100,1181,763],{"emptyLinePlaceholder":762},[100,1183,1185,1188,1190,1193,1196,1199,1201],{"class":241,"line":1184},76,[100,1186,1187],{"class":245},"    $result ",[100,1189,330],{"class":252},[100,1191,1192],{"class":245}," [",[100,1194,1195],{"class":252},"ordered",[100,1197,1198],{"class":245},"]",[100,1200,324],{"class":252},[100,1202,1203],{"class":245},"{\n",[100,1205,1207,1210,1212],{"class":241,"line":1206},77,[100,1208,1209],{"class":245},"        StartingFeature    ",[100,1211,330],{"class":252},[100,1213,1214],{"class":248}," $null\n",[100,1216,1218,1221,1223],{"class":241,"line":1217},78,[100,1219,1220],{"class":245},"        EndingFeature      ",[100,1222,330],{"class":252},[100,1224,1214],{"class":248},[100,1226,1228,1231,1233],{"class":241,"line":1227},79,[100,1229,1230],{"class":245},"        ServerSmb1Enabled  ",[100,1232,330],{"class":252},[100,1234,1214],{"class":248},[100,1236,1238,1241,1243],{"class":241,"line":1237},80,[100,1239,1240],{"class":245},"        AuditEnabled       ",[100,1242,330],{"class":252},[100,1244,1214],{"class":248},[100,1246,1248,1251,1253],{"class":241,"line":1247},81,[100,1249,1250],{"class":245},"        Smb1AccessEvents   ",[100,1252,330],{"class":252},[100,1254,1214],{"class":248},[100,1256,1258,1261,1263],{"class":241,"line":1257},82,[100,1259,1260],{"class":245},"        Action             ",[100,1262,330],{"class":252},[100,1264,1265],{"class":333}," \"none\"\n",[100,1267,1269,1272,1274],{"class":241,"line":1268},83,[100,1270,1271],{"class":245},"        RestartNeeded      ",[100,1273,330],{"class":252},[100,1275,1276],{"class":248}," $false\n",[100,1278,1280,1283,1285],{"class":241,"line":1279},84,[100,1281,1282],{"class":245},"        Error              ",[100,1284,330],{"class":252},[100,1286,1214],{"class":248},[100,1288,1290],{"class":241,"line":1289},85,[100,1291,1001],{"class":245},[100,1293,1295],{"class":241,"line":1294},86,[100,1296,763],{"emptyLinePlaceholder":762},[100,1298,1300,1303],{"class":241,"line":1299},87,[100,1301,1302],{"class":252},"    try",[100,1304,1162],{"class":245},[100,1306,1308,1311,1313,1316,1318,1321,1323,1326,1328],{"class":241,"line":1307},88,[100,1309,1310],{"class":245},"        $feature ",[100,1312,330],{"class":252},[100,1314,1315],{"class":248}," Get-WindowsOptionalFeature",[100,1317,253],{"class":252},[100,1319,1320],{"class":245},"Online ",[100,1322,259],{"class":252},[100,1324,1325],{"class":245},"FeatureName SMB1Protocol ",[100,1327,259],{"class":252},[100,1329,1330],{"class":245},"ErrorAction Stop\n",[100,1332,1334,1337,1339,1341,1343],{"class":241,"line":1333},89,[100,1335,1336],{"class":245},"        $result.StartingFeature ",[100,1338,330],{"class":252},[100,1340,1192],{"class":245},[100,1342,750],{"class":252},[100,1344,1345],{"class":245},"]$feature.State\n",[100,1347,1349],{"class":241,"line":1348},90,[100,1350,763],{"emptyLinePlaceholder":762},[100,1352,1354,1357,1360,1363,1366],{"class":241,"line":1353},91,[100,1355,1356],{"class":252},"        if",[100,1358,1359],{"class":245}," ($Mode ",[100,1361,1362],{"class":252},"-eq",[100,1364,1365],{"class":333}," \"Audit\"",[100,1367,1368],{"class":245},") {\n",[100,1370,1372,1375,1377,1380,1383,1385,1388,1390],{"class":241,"line":1371},92,[100,1373,1374],{"class":248},"            Set-SmbServerConfiguration",[100,1376,253],{"class":252},[100,1378,1379],{"class":245},"AuditSmb1Access ",[100,1381,1382],{"class":248},"$true",[100,1384,253],{"class":252},[100,1386,1387],{"class":245},"Force ",[100,1389,259],{"class":252},[100,1391,1330],{"class":245},[100,1393,1395,1398,1400],{"class":241,"line":1394},93,[100,1396,1397],{"class":245},"            $result.Action ",[100,1399,330],{"class":252},[100,1401,1402],{"class":333}," \"audit enabled\"\n",[100,1404,1406],{"class":241,"line":1405},94,[100,1407,1408],{"class":245},"        }\n",[100,1410,1412],{"class":241,"line":1411},95,[100,1413,763],{"emptyLinePlaceholder":762},[100,1415,1417,1419,1421,1423,1426],{"class":241,"line":1416},96,[100,1418,1356],{"class":252},[100,1420,1359],{"class":245},[100,1422,1362],{"class":252},[100,1424,1425],{"class":333}," \"Disable\"",[100,1427,1368],{"class":245},[100,1429,1431],{"class":241,"line":1430},97,[100,1432,1433],{"class":464},"            # Server side first: takes effect immediately, no restart needed.\n",[100,1435,1437,1440,1443,1445],{"class":241,"line":1436},98,[100,1438,1439],{"class":252},"            if",[100,1441,1442],{"class":245}," ((",[100,1444,43],{"class":248},[100,1446,1447],{"class":245},").EnableSMB1Protocol) {\n",[100,1449,1451,1454,1456,1459,1462,1464,1466,1468],{"class":241,"line":1450},99,[100,1452,1453],{"class":248},"                Set-SmbServerConfiguration",[100,1455,253],{"class":252},[100,1457,1458],{"class":245},"EnableSMB1Protocol ",[100,1460,1461],{"class":248},"$false",[100,1463,253],{"class":252},[100,1465,1387],{"class":245},[100,1467,259],{"class":252},[100,1469,1330],{"class":245},[100,1471,1473,1476,1478],{"class":241,"line":1472},100,[100,1474,1475],{"class":245},"                $result.Action ",[100,1477,330],{"class":252},[100,1479,1480],{"class":333}," \"server SMB1 off\"\n",[100,1482,1484],{"class":241,"line":1483},101,[100,1485,1486],{"class":245},"            }\n",[100,1488,1490],{"class":241,"line":1489},102,[100,1491,763],{"emptyLinePlaceholder":762},[100,1493,1495],{"class":241,"line":1494},103,[100,1496,1497],{"class":464},"            # Then disable the feature (SMBv1 client and server). Finishes at restart.\n",[100,1499,1501,1503,1506,1508,1511],{"class":241,"line":1500},104,[100,1502,1439],{"class":252},[100,1504,1505],{"class":245}," ($feature.State ",[100,1507,1040],{"class":252},[100,1509,1510],{"class":333}," \"Disabled\"",[100,1512,1368],{"class":245},[100,1514,1516,1519,1521,1524,1526,1528,1530,1532,1534,1537,1539],{"class":241,"line":1515},105,[100,1517,1518],{"class":245},"                $image ",[100,1520,330],{"class":252},[100,1522,1523],{"class":248}," Disable-WindowsOptionalFeature",[100,1525,253],{"class":252},[100,1527,1320],{"class":245},[100,1529,259],{"class":252},[100,1531,1325],{"class":245},[100,1533,259],{"class":252},[100,1535,1536],{"class":245},"NoRestart ",[100,1538,259],{"class":252},[100,1540,1330],{"class":245},[100,1542,1544,1547,1549,1551,1554],{"class":241,"line":1543},106,[100,1545,1546],{"class":245},"                $result.RestartNeeded ",[100,1548,330],{"class":252},[100,1550,1192],{"class":245},[100,1552,1553],{"class":252},"bool",[100,1555,1556],{"class":245},"]$image.RestartNeeded\n",[100,1558,1560,1562,1564],{"class":241,"line":1559},107,[100,1561,1475],{"class":245},[100,1563,330],{"class":252},[100,1565,1566],{"class":333}," \"disabled\"\n",[100,1568,1570],{"class":241,"line":1569},108,[100,1571,1486],{"class":245},[100,1573,1575],{"class":241,"line":1574},109,[100,1576,1408],{"class":245},[100,1578,1580],{"class":241,"line":1579},110,[100,1581,763],{"emptyLinePlaceholder":762},[100,1583,1585,1588,1590],{"class":241,"line":1584},111,[100,1586,1587],{"class":245},"        $config ",[100,1589,330],{"class":252},[100,1591,1592],{"class":248}," Get-SmbServerConfiguration\n",[100,1594,1596,1599,1601],{"class":241,"line":1595},112,[100,1597,1598],{"class":245},"        $result.ServerSmb1Enabled ",[100,1600,330],{"class":252},[100,1602,1603],{"class":245}," $config.EnableSMB1Protocol\n",[100,1605,1607,1610,1612],{"class":241,"line":1606},113,[100,1608,1609],{"class":245},"        $result.AuditEnabled ",[100,1611,330],{"class":252},[100,1613,1614],{"class":245}," $config.AuditSmb1Access\n",[100,1616,1618,1621,1623,1625,1627,1630,1633,1635,1637,1639],{"class":241,"line":1617},114,[100,1619,1620],{"class":245},"        $result.EndingFeature ",[100,1622,330],{"class":252},[100,1624,1192],{"class":245},[100,1626,750],{"class":252},[100,1628,1629],{"class":245},"](",[100,1631,1632],{"class":248},"Get-WindowsOptionalFeature",[100,1634,253],{"class":252},[100,1636,1320],{"class":245},[100,1638,259],{"class":252},[100,1640,1641],{"class":245},"FeatureName SMB1Protocol).State\n",[100,1643,1645],{"class":241,"line":1644},115,[100,1646,763],{"emptyLinePlaceholder":762},[100,1648,1650,1653,1655,1658],{"class":241,"line":1649},116,[100,1651,1652],{"class":245},"        $filter ",[100,1654,330],{"class":252},[100,1656,1657],{"class":252}," @",[100,1659,1203],{"class":245},[100,1661,1663,1666,1668],{"class":241,"line":1662},117,[100,1664,1665],{"class":245},"            LogName   ",[100,1667,330],{"class":252},[100,1669,1670],{"class":333}," \"Microsoft-Windows-SMBServer\u002FAudit\"\n",[100,1672,1674,1677,1679],{"class":241,"line":1673},118,[100,1675,1676],{"class":245},"            Id        ",[100,1678,330],{"class":252},[100,1680,1681],{"class":248}," 3000\n",[100,1683,1685,1688,1690,1692,1695,1698,1700],{"class":241,"line":1684},119,[100,1686,1687],{"class":245},"            StartTime ",[100,1689,330],{"class":252},[100,1691,951],{"class":245},[100,1693,1694],{"class":248},"Get-Date",[100,1696,1697],{"class":245},").AddDays(",[100,1699,259],{"class":252},[100,1701,1702],{"class":245},"$AuditDays)\n",[100,1704,1706],{"class":241,"line":1705},120,[100,1707,1408],{"class":245},[100,1709,1711,1714,1716,1718,1720,1722,1724,1727,1729],{"class":241,"line":1710},121,[100,1712,1713],{"class":245},"        $result.Smb1AccessEvents ",[100,1715,330],{"class":252},[100,1717,1657],{"class":252},[100,1719,826],{"class":245},[100,1721,306],{"class":248},[100,1723,253],{"class":252},[100,1725,1726],{"class":245},"FilterHashtable $filter ",[100,1728,259],{"class":252},[100,1730,1731],{"class":245},"ErrorAction SilentlyContinue).Count\n",[100,1733,1735,1738,1741],{"class":241,"line":1734},122,[100,1736,1737],{"class":245},"    } ",[100,1739,1740],{"class":252},"catch",[100,1742,1162],{"class":245},[100,1744,1746,1749,1751],{"class":241,"line":1745},123,[100,1747,1748],{"class":245},"        $result.Action ",[100,1750,330],{"class":252},[100,1752,1753],{"class":333}," \"failed\"\n",[100,1755,1757,1760,1762,1765],{"class":241,"line":1756},124,[100,1758,1759],{"class":245},"        $result.Error ",[100,1761,330],{"class":252},[100,1763,1764],{"class":248}," $_",[100,1766,1767],{"class":245},".Exception.Message\n",[100,1769,1771],{"class":241,"line":1770},125,[100,1772,1001],{"class":245},[100,1774,1776],{"class":241,"line":1775},126,[100,1777,763],{"emptyLinePlaceholder":762},[100,1779,1781,1783,1786],{"class":241,"line":1780},127,[100,1782,747],{"class":245},[100,1784,1785],{"class":252},"PSCustomObject",[100,1787,1788],{"class":245},"]$result\n",[100,1790,1792],{"class":241,"line":1791},128,[100,1793,938],{"class":245},[100,1795,1797],{"class":241,"line":1796},129,[100,1798,763],{"emptyLinePlaceholder":762},[100,1800,1802,1805,1807,1809],{"class":241,"line":1801},130,[100,1803,1804],{"class":245},"$invokeParams ",[100,1806,330],{"class":252},[100,1808,1657],{"class":252},[100,1810,1203],{"class":245},[100,1812,1814,1817,1819],{"class":241,"line":1813},131,[100,1815,1816],{"class":245},"    ComputerName  ",[100,1818,330],{"class":252},[100,1820,1821],{"class":245}," $ComputerName\n",[100,1823,1825,1828,1830],{"class":241,"line":1824},132,[100,1826,1827],{"class":245},"    ScriptBlock   ",[100,1829,330],{"class":252},[100,1831,1832],{"class":245}," $smb1Script\n",[100,1834,1836,1839,1841,1844,1846],{"class":241,"line":1835},133,[100,1837,1838],{"class":245},"    ArgumentList  ",[100,1840,330],{"class":252},[100,1842,1843],{"class":245}," $mode",[100,1845,370],{"class":252},[100,1847,1848],{"class":245}," $AuditDays\n",[100,1850,1852,1855,1857],{"class":241,"line":1851},134,[100,1853,1854],{"class":245},"    ThrottleLimit ",[100,1856,330],{"class":252},[100,1858,1859],{"class":245}," $ThrottleLimit\n",[100,1861,1863,1866,1868],{"class":241,"line":1862},135,[100,1864,1865],{"class":245},"    ErrorAction   ",[100,1867,330],{"class":252},[100,1869,1870],{"class":333}," \"SilentlyContinue\"\n",[100,1872,1874,1877,1879],{"class":241,"line":1873},136,[100,1875,1876],{"class":245},"    ErrorVariable ",[100,1878,330],{"class":252},[100,1880,1881],{"class":333}," \"remoteErrors\"\n",[100,1883,1885],{"class":241,"line":1884},137,[100,1886,938],{"class":245},[100,1888,1890],{"class":241,"line":1889},138,[100,1891,763],{"emptyLinePlaceholder":762},[100,1893,1895,1898,1900,1903],{"class":241,"line":1894},139,[100,1896,1897],{"class":245},"$results ",[100,1899,330],{"class":252},[100,1901,1902],{"class":248}," Invoke-Command",[100,1904,1905],{"class":245}," @invokeParams\n",[100,1907,1909],{"class":241,"line":1908},140,[100,1910,763],{"emptyLinePlaceholder":762},[100,1912,1914,1917,1920,1923,1926,1928,1931,1933],{"class":241,"line":1913},141,[100,1915,1916],{"class":252},"foreach",[100,1918,1919],{"class":245}," ($result ",[100,1921,1922],{"class":252},"in",[100,1924,1925],{"class":245}," ($results ",[100,1927,1025],{"class":252},[100,1929,1930],{"class":248}," Sort-Object",[100,1932,253],{"class":252},[100,1934,1935],{"class":245},"Property PSComputerName)) {\n",[100,1937,1939,1942,1944],{"class":241,"line":1938},142,[100,1940,1941],{"class":245},"    $target ",[100,1943,330],{"class":252},[100,1945,1946],{"class":245}," $result.PSComputerName\n",[100,1948,1950],{"class":241,"line":1949},143,[100,1951,763],{"emptyLinePlaceholder":762},[100,1953,1955,1957],{"class":241,"line":1954},144,[100,1956,963],{"class":252},[100,1958,1959],{"class":245}," ($result.Error) {\n",[100,1961,1963,1966,1969,1972,1975,1977,1979,1982,1985],{"class":241,"line":1962},145,[100,1964,1965],{"class":248},"        Write-Host",[100,1967,1968],{"class":333}," \"",[100,1970,1971],{"class":245},"$target",[100,1973,1974],{"class":333},"`: failed - ",[100,1976,1113],{"class":252},[100,1978,826],{"class":333},[100,1980,1981],{"class":245},"$result.Error",[100,1983,1984],{"class":333},")",[100,1986,1987],{"class":333},"\"\n",[100,1989,1991,1993,1995,1998,2000,2003],{"class":241,"line":1990},146,[100,1992,1737],{"class":245},[100,1994,1078],{"class":252},[100,1996,1997],{"class":245}," ($result.Action ",[100,1999,1362],{"class":252},[100,2001,2002],{"class":333}," \"disabled\"",[100,2004,1368],{"class":245},[100,2006,2008,2011,2013,2015,2018,2021,2023,2025,2027,2030],{"class":241,"line":2007},147,[100,2009,2010],{"class":245},"        $state ",[100,2012,330],{"class":252},[100,2014,1067],{"class":252},[100,2016,2017],{"class":245}," ($result.RestartNeeded) { ",[100,2019,2020],{"class":333},"\"restart pending\"",[100,2022,345],{"class":245},[100,2024,1089],{"class":252},[100,2026,1031],{"class":245},[100,2028,2029],{"class":333},"\"no restart needed\"",[100,2031,1046],{"class":245},[100,2033,2035,2037,2039,2041,2044,2047,2050,2052,2054,2057,2059,2062,2064,2066,2068,2070,2073,2076,2079,2081,2083,2085,2088,2091],{"class":241,"line":2034},148,[100,2036,1965],{"class":248},[100,2038,1968],{"class":333},[100,2040,1971],{"class":245},[100,2042,2043],{"class":333},"`: disabled, ",[100,2045,2046],{"class":245},"$state",[100,2048,2049],{"class":333}," (feature ",[100,2051,1113],{"class":252},[100,2053,826],{"class":333},[100,2055,2056],{"class":245},"$result.EndingFeature",[100,2058,1984],{"class":333},[100,2060,2061],{"class":333},", server SMB1 ",[100,2063,1113],{"class":252},[100,2065,826],{"class":333},[100,2067,914],{"class":252},[100,2069,951],{"class":333},[100,2071,2072],{"class":245},"$result.ServerSmb1Enabled",[100,2074,2075],{"class":333},") { ",[100,2077,2078],{"class":333},"'on'",[100,2080,345],{"class":333},[100,2082,1089],{"class":252},[100,2084,1031],{"class":333},[100,2086,2087],{"class":333},"'off'",[100,2089,2090],{"class":333}," })",[100,2092,2093],{"class":333},")\"\n",[100,2095,2097,2099,2101,2104,2106,2108,2111,2113],{"class":241,"line":2096},149,[100,2098,1737],{"class":245},[100,2100,1078],{"class":252},[100,2102,2103],{"class":245}," ($result.EndingFeature ",[100,2105,1362],{"class":252},[100,2107,1510],{"class":333},[100,2109,2110],{"class":252}," -and",[100,2112,976],{"class":252},[100,2114,2115],{"class":245}," $result.ServerSmb1Enabled) {\n",[100,2117,2119,2121,2123,2125],{"class":241,"line":2118},150,[100,2120,1965],{"class":248},[100,2122,1968],{"class":333},[100,2124,1971],{"class":245},[100,2126,2127],{"class":333},"`: already disabled, nothing to do\"\n",[100,2129,2131,2133,2135],{"class":241,"line":2130},151,[100,2132,1737],{"class":245},[100,2134,1089],{"class":252},[100,2136,1162],{"class":245},[100,2138,2140,2142,2144,2146,2149,2151,2153,2155,2157,2160,2162,2164,2166,2168,2171,2173,2175,2178,2180,2182,2184,2186,2189,2191,2194,2197],{"class":241,"line":2139},152,[100,2141,1965],{"class":248},[100,2143,1968],{"class":333},[100,2145,1971],{"class":245},[100,2147,2148],{"class":333},"`: SMBv1 feature ",[100,2150,1113],{"class":252},[100,2152,826],{"class":333},[100,2154,2056],{"class":245},[100,2156,1984],{"class":333},[100,2158,2159],{"class":333},", server SMB1 enabled ",[100,2161,1113],{"class":252},[100,2163,826],{"class":333},[100,2165,2072],{"class":245},[100,2167,1984],{"class":333},[100,2169,2170],{"class":333},", audit ",[100,2172,1113],{"class":252},[100,2174,826],{"class":333},[100,2176,2177],{"class":245},"$result.AuditEnabled",[100,2179,1984],{"class":333},[100,2181,44],{"class":333},[100,2183,1113],{"class":252},[100,2185,826],{"class":333},[100,2187,2188],{"class":245},"$result.Smb1AccessEvents",[100,2190,1984],{"class":333},[100,2192,2193],{"class":333}," access event(s) in ",[100,2195,2196],{"class":245},"$AuditDays",[100,2198,2199],{"class":333}," days\"\n",[100,2201,2203],{"class":241,"line":2202},153,[100,2204,1001],{"class":245},[100,2206,2208],{"class":241,"line":2207},154,[100,2209,938],{"class":245},[100,2211,2213],{"class":241,"line":2212},155,[100,2214,763],{"emptyLinePlaceholder":762},[100,2216,2218,2220],{"class":241,"line":2217},156,[100,2219,1897],{"class":245},[100,2221,2222],{"class":252},"|\n",[100,2224,2226,2229,2231,2234,2236,2239,2241,2244,2246,2249,2251,2254,2256,2259,2261,2264,2266,2269,2271,2274],{"class":241,"line":2225},157,[100,2227,2228],{"class":248},"    Select-Object",[100,2230,253],{"class":252},[100,2232,2233],{"class":245},"Property PSComputerName",[100,2235,370],{"class":252},[100,2237,2238],{"class":245}," StartingFeature",[100,2240,370],{"class":252},[100,2242,2243],{"class":245}," EndingFeature",[100,2245,370],{"class":252},[100,2247,2248],{"class":245}," ServerSmb1Enabled",[100,2250,370],{"class":252},[100,2252,2253],{"class":245}," AuditEnabled",[100,2255,370],{"class":252},[100,2257,2258],{"class":245}," Smb1AccessEvents",[100,2260,370],{"class":252},[100,2262,2263],{"class":245}," Action",[100,2265,370],{"class":252},[100,2267,2268],{"class":245}," RestartNeeded",[100,2270,370],{"class":252},[100,2272,2273],{"class":245}," Error ",[100,2275,2222],{"class":252},[100,2277,2279,2282,2284,2287,2289],{"class":241,"line":2278},158,[100,2280,2281],{"class":248},"    Export-Csv",[100,2283,253],{"class":252},[100,2285,2286],{"class":245},"Path $OutputPath ",[100,2288,259],{"class":252},[100,2290,2291],{"class":245},"NoTypeInformation\n",[100,2293,2295],{"class":241,"line":2294},159,[100,2296,763],{"emptyLinePlaceholder":762},[100,2298,2300,2302,2305,2307],{"class":241,"line":2299},160,[100,2301,1916],{"class":252},[100,2303,2304],{"class":245}," ($failure ",[100,2306,1922],{"class":252},[100,2308,2309],{"class":245}," $remoteErrors) {\n",[100,2311,2313,2316,2319,2321,2323,2326,2328,2331,2333,2335,2338,2340],{"class":241,"line":2312},161,[100,2314,2315],{"class":248},"    Write-Warning",[100,2317,2318],{"class":333}," \"Unreachable: ",[100,2320,1113],{"class":252},[100,2322,826],{"class":333},[100,2324,2325],{"class":245},"$failure.TargetObject",[100,2327,1984],{"class":333},[100,2329,2330],{"class":333}," - ",[100,2332,1113],{"class":252},[100,2334,826],{"class":333},[100,2336,2337],{"class":245},"$failure.Exception.Message",[100,2339,1984],{"class":333},[100,2341,1987],{"class":333},[100,2343,2345],{"class":241,"line":2344},162,[100,2346,938],{"class":245},[100,2348,2350],{"class":241,"line":2349},163,[100,2351,763],{"emptyLinePlaceholder":762},[100,2353,2355,2357,2360,2363],{"class":241,"line":2354},164,[100,2356,1107],{"class":248},[100,2358,2359],{"class":333}," \"Results written to ",[100,2361,2362],{"class":245},"$OutputPath",[100,2364,1987],{"class":333},[20,2366,2368],{"id":2367},"notes","Notes",[25,2370,2371,2407,2427,2440,2478,2484],{},[28,2372,2373,2377,2378,2381,2382,2385,2386,2389,2390,2393,2394,2396,2397,2399,2400,2403,2404,179],{},[2374,2375,2376],"strong",{},"Two switches, two effects."," ",[15,2379,2380],{},"Set-SmbServerConfiguration -EnableSMB1Protocol $false"," stops the SMB server from accepting SMBv1, and Microsoft notes you \"don't have to restart the computer\" after it. ",[15,2383,2384],{},"Disable-WindowsOptionalFeature -FeatureName SMB1Protocol"," disables the SMBv1 feature, client and server, and needs a restart to finish, which is why the script records ",[15,2387,2388],{},"RestartNeeded"," and the post-change feature state separately. Without ",[15,2391,2392],{},"-Remove"," it leaves the payload files on disk, so the feature can be re-enabled without installation media; add ",[15,2395,2392],{}," only if you want the binaries gone too. Don't treat a server as done until a ",[15,2398,149],{}," pass after the restart shows ",[15,2401,2402],{},"EndingFeature"," as ",[15,2405,2406],{},"Disabled",[28,2408,2409,2412,2413,2415,2416,2418,2419,2421,2422,2426],{},[2374,2410,2411],{},"Auditing only sees the server side."," With ",[15,2414,141],{}," on, every SMBv1 connection attempt to that server logs event ID 3000 in ",[15,2417,174],{},"; open the events (the ",[15,2420,306],{}," example above) to see the client details. It tells you nothing about servers that ",[2423,2424,2425],"em",{},"initiate"," SMBv1 connections outward, for example to an old NAS or a scan-to-folder copier. Check those devices from the other side or with the vendor.",[28,2428,2429,2432,2433,2439],{},[2374,2430,2431],{},"Domain controllers."," Microsoft warns that \"some systems require access to the SYSVOL folder or other file shares but don't support SMBv2 or SMBv3,\" such as legacy Windows and older Linux or partner systems. Audit DCs longest and do them last. Microsoft keeps an SMB1 Product Clearinghouse (",[2434,2435,2436],"a",{"href":2436,"rel":2437},"https:\u002F\u002Faka.ms\u002Fstillneedssmb1",[2438],"nofollow",") of products that required SMBv1 and the updates that remove the requirement.",[28,2441,2442,2445,2446,2449,2450,2453,2454,2449,2457,2460,2461,2464,2465,44,2468,44,2471,2474,2475,2477],{},[2374,2443,2444],{},"Group Policy instead of a script."," For ongoing enforcement Microsoft documents registry preference items: ",[15,2447,2448],{},"HKLM\\SYSTEM\\CurrentControlSet\\Services\\LanmanServer\\Parameters\\SMB1"," = ",[15,2451,2452],{},"0"," (REG_DWORD) for the server, and for the client, ",[15,2455,2456],{},"HKLM\\SYSTEM\\CurrentControlSet\\services\\mrxsmb10\\Start",[15,2458,2459],{},"4"," plus ",[15,2462,2463],{},"LanmanWorkstation\\DependOnService"," replaced with ",[15,2466,2467],{},"Bowser",[15,2469,2470],{},"MRxSmb20",[15,2472,2473],{},"NSI",". Both need a restart. That's also the method for Server 2008 R2 and Windows 7, which have no ",[15,2476,17],{}," feature.",[28,2479,2480,2483],{},[2374,2481,2482],{},"Don't confuse this with signing."," On Windows 11 24H2 and Windows Server 2025, SMB signing is required by default, which can break connections to third-party SMB servers that don't sign. Microsoft is explicit that changing which SMB versions are enabled doesn't change the signing requirement, so don't re-enable SMBv1 (or disable signing) to \"fix\" those failures.",[28,2485,2486],{},"I stage this in batches by server role rather than all at once: file and print servers first (where legacy SMBv1 clients are most likely to show up in the audit log), then application servers, and domain controllers last, with a week between batches to let any breakage show up in help desk tickets before the blast radius grows.",[20,2488,2490],{"id":2489},"source","Source",[25,2492,2493,2500,2507,2513,2520],{},[28,2494,2495],{},[2434,2496,2499],{"href":2497,"rel":2498},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fstorage\u002Ffile-server\u002Ftroubleshoot\u002Fdetect-enable-and-disable-smbv1-v2-v3",[2438],"Detect, enable, and disable SMBv1, SMBv2, and SMBv3 in Windows",[28,2501,2502],{},[2434,2503,2506],{"href":2504,"rel":2505},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows-server\u002Fstorage\u002Ffile-server\u002Ftroubleshoot\u002Fsmbv1-not-installed-by-default-in-windows",[2438],"SMBv1 is not installed by default in Windows",[28,2508,2509],{},[2434,2510,47],{"href":2511,"rel":2512},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fpowershell\u002Fmodule\u002Fsmbshare\u002Fset-smbserverconfiguration",[2438],[28,2514,2515],{},[2434,2516,2519],{"href":2517,"rel":2518},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fpowershell\u002Fmodule\u002Fdism\u002Fdisable-windowsoptionalfeature",[2438],"Disable-WindowsOptionalFeature",[28,2521,2522],{},[2434,2523,2526],{"href":2524,"rel":2525},"https:\u002F\u002Ftechcommunity.microsoft.com\u002Fblog\u002Ffilecab\u002Fstop-using-smb1\u002F425858",[2438],"Stop using SMB1 (Microsoft Storage blog)",[2528,2529,2530],"style",{},"html pre.shiki code .s95oV, html code.shiki .s95oV{--shiki-default:#E1E4E8}html pre.shiki code .sDLfK, html code.shiki .sDLfK{--shiki-default:#79B8FF}html pre.shiki code .snl16, html code.shiki .snl16{--shiki-default:#F97583}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sU2Wk, html code.shiki .sU2Wk{--shiki-default:#9ECBFF}html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}",{"title":236,"searchDepth":359,"depth":359,"links":2532},[2533,2534,2535,2536,2537,2538],{"id":22,"depth":359,"text":23},{"id":61,"depth":359,"text":62},{"id":225,"depth":359,"text":226},{"id":453,"depth":359,"text":454},{"id":2367,"depth":359,"text":2368},{"id":2489,"depth":359,"text":2490},"techcolumnist",[2541,2542],"ps","scripts","2025-11-26T14:00:00Z","A script that audits SMBv1 access (event 3000), disables the SMBv1 server and optional feature across Windows servers, and reports which ones still need a restart.","md",false,null,{},"\u002Fblog\u002F2025\u002F11\u002F26\u002Fpowershell-windows-server-disable-smbv1-fleet-wide-and-verify-it-stuck",{"title":6,"description":2544},[2539],"blog\u002F2025\u002F11\u002F26\u002Fpowershell-windows-server-disable-smbv1-fleet-wide-and-verify-it-stuck",[235,2554],"windows","\u002F2025\u002F11\u002F26\u002Fpowershell-windows-server-disable-smbv1-fleet-wide-and-verify-it-stuck\u002F","cpdTK5bYOZ1p6ka3r0vm2x45hgwaeyvrtABMHEjnlJY",{"title":2558,"description":2559,"date":2560,"url":2561,"categories":2562,"tags":2563,"image":2547,"readingTime":489,"canonical":2539,"sites":2566,"series":2547,"seriesOrder":2547},"PowerShell: Active Directory – Report Group Membership Sprawl","Rank AD security groups by nesting depth, transitive member count, ownership and staleness for an access review, plus a per-user Kerberos token size estimate.","2025-12-03T14:00:00Z","\u002F2025\u002F12\u002F03\u002Fpowershell-active-directory-report-group-membership-sprawl\u002F",[2541,2542],[235,2564,2565],"active-directory","reporting",[2539],{"title":2568,"description":2569,"date":2570,"url":2571,"categories":2572,"tags":2573,"image":2547,"readingTime":481,"canonical":2539,"sites":2575,"series":2547,"seriesOrder":2547},"PowerShell: Azure – Audit Who Has Owner Role Across All Subscriptions","A script that walks every subscription a credential can see and reports every Owner assignment, active or PIM-eligible, by the scope it was granted at.","2025-11-19T14:00:00Z","\u002F2025\u002F11\u002F19\u002Fpowershell-azure-audit-who-has-owner-role-across-all-subscriptions\u002F",[2541,2542],[235,2574],"azure",[2539],[2577,2586,2594],{"title":2578,"description":2579,"date":2580,"url":2581,"categories":2582,"tags":2583,"image":2547,"readingTime":489,"canonical":2539,"sites":2585,"series":2547,"seriesOrder":2547},"PowerShell: Windows – Discover Local Admins Across Every Workstation","A script that reads the local Administrators group on every workstation by SID, survives orphaned-SID errors, and flags members outside an approved allowlist.","2025-10-08T14:00:00Z","\u002F2025\u002F10\u002F08\u002Fpowershell-windows-discover-local-admins-across-every-workstation\u002F",[2541,2542],[235,2554,2584,2564],"discovery",[2539],{"title":2587,"description":2588,"date":2589,"url":2590,"categories":2591,"tags":2592,"image":2547,"readingTime":489,"canonical":2539,"sites":2593,"series":2547,"seriesOrder":2547},"PowerShell: Windows Server – Harden RDP Without Breaking Access","A PowerShell script that locks down Windows Server RDP: NLA, TLS-only, session limits, redirection, a firewall allowlist, Restricted Admin support and legacy TLS off.","2025-09-17T14:00:00Z","\u002F2025\u002F09\u002F17\u002Fpowershell-windows-server-harden-rdp-without-breaking-access\u002F",[2541,2542],[235,2554],[2539],{"title":2595,"description":2596,"date":2597,"url":2598,"categories":2599,"tags":2600,"image":2547,"readingTime":495,"canonical":2539,"sites":2602,"series":2547,"seriesOrder":2547},"PowerShell: Intune – Remediation Script for Stuck BitLocker Encryption","An Intune Remediations detect and remediate pair that finds paused, suspended or stalled BitLocker encryption on Windows and fixes the cases that have a documented fix.","2025-09-10T14:00:00Z","\u002F2025\u002F09\u002F10\u002Fpowershell-intune-remediation-script-for-stuck-bitlocker-encryption\u002F",[2541,2542],[235,2601,2554],"intune",[2539],{"doc":2547,"posts":2604},[],1790052513228]