Last active
May 16, 2017 13:42
-
-
Save janegilring/4a3f0731daa78fdb791be05af2bbfd14 to your computer and use it in GitHub Desktop.
Examples on how SMB1 can be removed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Suggestion 1: Define in PowerShell DSC configurations for target systems that SMB 1 should be absent | |
| configuration HyperV { | |
| Import-DscResource -ModuleName PSDesiredStateConfiguration | |
| node localhost { | |
| WindowsFeature SMB1 { | |
| Ensure = 'Absent' | |
| Name = 'FS-SMB1' | |
| } | |
| } | |
| } | |
| # Suggestion 2: Uninstall SMB 1 from base images so that new machines is not created with SMB 1 enabled. This is an example on how to do it using offline servicing. | |
| Uninstall-WindowsFeature -Vhd 'D:\VM Templates\WS2016Base.vhdx' -Name FS-SMB1 -Remove | |
| # Suggestion 3: Identify target systems you can safely remove SMB 1 from. | |
| # The below example is targeting Hyper-V hosts, which you can safely remove SMB 1 from. | |
| # Get all Hyper-V servers from System Center Virtual Machine Manager (Nano Server is being excluded since SMB 1 is already absent) | |
| Import-Module -Name VirtualMachineManager | |
| $HyperVHosts = Get-SCVMHost | Select-Object -Property *,@{name='VMMAgentVersion';e={$_.Agent.AgentVersion.ToString()}} | Where-Object { | |
| $_.VirtualizationPlatform -eq 'HyperV' -and | |
| $_.VMMAgentVersion -NotLike "10.*" -and | |
| $_.CommunicationStateString -eq 'Responding' | |
| } | Sort-Object Name | |
| $SMB1StatusBefore = Invoke-Command -ComputerName $HyperVHosts.Name -ScriptBlock {Get-WindowsFeature -Name FS-SMB1} | Select-Object Name,Installed,PSComputerName | |
| $Removal = Invoke-Command -ComputerName $HyperVHosts.Name -ScriptBlock { | |
| if ((Get-WindowsFeature -Name FS-SMB1).Installed) { | |
| Uninstall-WindowsFeature -Name FS-SMB1 | |
| } | |
| } | |
| $SMB1StatusAfter = Invoke-Command -ComputerName $HyperVHosts.Name -ScriptBlock {Get-WindowsFeature -Name FS-SMB1} | Select-Object Name,Installed,PSComputerName | |
| # Inspect changes | |
| Compare-Object -ReferenceObject $SMB1StatusBefore -DifferenceObject $SMB1StatusAfter -Property Installed -IncludeEqual | |
| # Do note that a reboot is required after uninstalling SMB 1 from a running system |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment