SV-205682r958478: Windows Server 2019 must not have the Server Message Block (SMB) v1 protocol installed. | Microsoft Windows Server 2019 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

Windows Server 2019 must not have the Server Message Block (SMB) v1 protocol installed.

Description

Discussion Text

SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks and is not FIPS compliant.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000381V-93391SV-103477

References

DPMS Target Microsoft Windows Server 2019 DISA DPMS Target Microsoft Windows Server 2019 2907

Checks

DISA STIG (Manual Reference)

Different methods are available to disable SMBv1 on Windows Server 2019. This is the preferred method; however, if WN19-00-000390 and WN19-00-000400 are configured, this is NA.

Open "Windows PowerShell" with elevated privileges (run as administrator).

Enter "Get-WindowsFeature -Name FS-SMB1".

If "Installed State" is "Installed", this is a finding.

An Installed State of "Available" or "Removed" is not a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

# Windows PowerShell
# Reconstructed from oval:mil.disa.stig.windows2019:def:205682
# Windows Server 2019 must not have the Server Message Block (SMB) v1 protocol installed.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# Verifies 'SMB 1.0/CIFS File Sharing Support' feature is not installed
# wmi57_object (wmi57_test)
function test_1 {
  return (((Get-CimInstance -Namespace 'root\cimv2' -Query 'SELECT installstate FROM win32_optionalfeature WHERE name = ''SMB1Protocol''' | Select-Object -First 1) | Select-Object -ExpandProperty 'installstate') -eq '2')
}
# Verifies 'SMB 1.0/CIFS File Sharing Support' feature is not installed
# wmi57_object (wmi57_test)
function test_2 {
  return (((Get-CimInstance -Namespace 'root\cimv2' -Query 'SELECT installstate FROM win32_optionalfeature WHERE name = ''SMB1Protocol''' | Select-Object -First 1) | Select-Object -ExpandProperty 'installstate') -eq '2')
}
# Verifies 'Configure SMBv1 Server' is set to 'Disabled'
# registry_object (registry_test)
function test_3 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters').GetValueKind('SMB1').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters' -Name 'SMB1' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'SMB1') -eq 0))
}
# Verifies 'SMB 1.0/CIFS File Sharing Support' feature is not installed
# wmi57_object (wmi57_test)
function test_4 {
  return (((Get-CimInstance -Namespace 'root\cimv2' -Query 'SELECT installstate FROM win32_optionalfeature WHERE name = ''SMB1Protocol''' | Select-Object -First 1) | Select-Object -ExpandProperty 'installstate') -eq '2')
}
# Verifies 'Configure SMBv1 client driver' is set to 'Enabled' with 'Disable driver (recommended)' selected for 'Configure MrxSmb10 driver'
# registry_object (registry_test)
function test_5 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mrxsmb10').GetValueKind('Start').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mrxsmb10' -Name 'Start' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'Start') -eq 4))
}

if ((test_1 -or ((test_2 -or test_3) -and (test_4 -or test_5)))) {
  Write-Output "PASS"
} else {
  Write-Output "FAIL"
}

Assessment Script Powered by AISyntax-verified

A standalone PowerShell script to assess this control automatically. Review before running it in your environment.

Syntax-checked as valid PowerShell. Not executed here — running it for real needs the actual ms_windows_server_2019 target this check assesses.

# OVAL Definition: oval:mil.disa.stig.windows2019:def:205682
if (!(Get-CimInstance -ClassName Win32_OptionalFeature -Filter "Name='SMB1Protocol'").InstallState -eq 2 -and (Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters' -Name 'SMB1' -ErrorAction SilentlyContinue).SMB1 -eq 0) { Write-Output "FAIL"; Exit 1 } else { Write-Output "PASS"; Exit 0 }

Remediation

Uninstall the SMBv1 protocol.

Open "Windows PowerShell" with elevated privileges (run as administrator).

Enter "Uninstall-WindowsFeature -Name FS-SMB1 -Restart".
(Omit the Restart parameter if an immediate restart of the system cannot be done.)

Alternately:

Start "Server Manager".

Select the server with the feature.

Scroll down to "ROLES AND FEATURES" in the right pane.

Select "Remove Roles and Features" from the drop-down "TASKS" list.

Select the appropriate server on the "Server Selection" page and click "Next".

Deselect "SMB 1.0/CIFS File Sharing Support" on the "Features" page.

Click "Next" and "Remove" as prompted.