AD-DC-02: SMBv1 should be disabled on all domain controllers


ID	`AD-DC-02`
Severity	High
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Domain controllers
Security area	Infrastructure hardening
Resource type	DomainController
User impact of fixing	Low
Effort to fix	Medium
Framework controls	`nist-800-53-r5:CM-7` Least Functionality
MITRE ATT&CK	T1210
Reads from	On-premises Active Directory

What this checks and how to fix it

SMBv1 (Server Message Block version 1) is an outdated protocol with significant security vulnerabilities:

EternalBlue exploit: Used in WannaCry and NotPetya ransomware attacks
No encryption: SMBv1 traffic is not encrypted
No integrity checks: Vulnerable to man-in-the-middle attacks
Deprecated by Microsoft: Microsoft strongly recommends disabling SMBv1

Domain controllers with SMBv1 enabled pose a critical security risk as they are high-value targets for attackers.

Control Type

Preventive

Security Recommendation

Disable SMBv1 on all domain controllers immediately.

To disable SMBv1 on a domain controller:

#### Check current status
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol

#### Disable SMBv1
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force

#### Disable SMBv1 feature (requires restart)
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

How the Test Works

This test queries the SMB server configuration on each domain controller to check if SMBv1 protocol is enabled. It reports:

Number of DCs with SMBv1 enabled
Names of affected DCs
Overall security status

Test-MtAdDcSmbSigningEnabledCount - SMB signing configuration
Test-MtAdDcSmbv311EnabledCount - SMBv3.1.1 protocol status

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).