How PDQ Inventory detects SMBv1

Purpose:

You want to ensure the reporting for SMB is correct in the computer info tab from a target in PDQ Inventory. The reporting method is true or false based on both the SMB client and SMB server settings. Both have to be set off to have a reported value false. 

Resolution:

Ensure both Client and Server settings are both set to the desired setting.

• For Client:
  • Win 10 or higher:
    • Check for WMI "select * from Win32_OptionalFeature where Name == ‘SMB1Protocol’".
    • If "InstallState" != 1, then client is disabled.
  • Otherwise:
    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\mrxsmb10
    • Check for Start value. If it is 4, then the client is disabled.
• For the Server:
  • Win 8 or higher:
    • WMI class MSFT_SmbServerConfiguration in "\ROOT\Microsoft\Windows\SMB", call method "GetConfiguration".
    • If the output of EnableSMB1Protocol is true, the server is enabled.
  • Otherwise:
    • "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
    • Get value "SMB1", if the value does not equal 0, then the server is enabled.

For more information on Detecting, Enabling or Disabling SMB versions please refer to this article by Microsoft. https://docs.microsoft.com/en-us/windows-server/storage/file-server/troubleshoot/detect-enable-and-disable-smbv1-v2-v3