How PDQ Inventory detects SMBv1

Purpose

You wish to verify that the reported SMB version is correct in the computer info tab a target computer in PDQ Inventory. The reporting method displays True or False based on both the SMB client and SMB server settings. Both have to be set off to have a reported value false.

Resolution

Verify both the Client and Server settings are configured for the desired setting.

• SMB Client:
  • Windows 10 or higher:
    • Check for WMI "select * from Win32_OptionalFeature where Name == 'SMB1Protocol'".
    • If "InstallState" != 1, then client is disabled.
  • Otherwise:
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\mrxsmb10
    • Check for Start value. If it is 4, then the client is disabled.
• SMB Server:
  • Windows 8 or higher:
    • WMI class MSFT_SmbServerConfiguration in "\ROOT\Microsoft\Windows\SMB", call method "GetConfiguration".
    • If the output of EnableSMB1Protocol is true, the server is enabled.
  • Otherwise:
    • "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
    • Get value "SMB1", if the value does not equal 0, then the server is enabled.

For more information on Detecting, Enabling or Disabling SMB versions please refer to this article by Microsoft. https://docs.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/detect-enable-and-disable-smbv1-v2-v3