cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
ChrisParr1
Engaged Sweeper III

We've got SMBv1 Auditing enabled on our domain and SMBv1 disabled on everything including the Lansweeper scan servers.

We're seeing event log entries on our DCs from both of our scan servers like the one below. Nothing else is generating these events, just the scan servers. Judging by the timings it looks like it's IP range scanning that is triggering it.

--------------------------

Log Name: Microsoft-Windows-SMBServer/Audit
Source: Microsoft-Windows-SMBServer
Date: 5/30/2023 7:10:10 AM
Event ID: 3000
Task Category: None
Level: Information
Keywords:
User: N/A
Computer: DC01.Domain.Local
Description:
SMB1 access

Client Address: SCANServer01

--------------------------

Is there any way we can prevent scans from triggering this?

6 REPLIES 6
ChrisParr1
Engaged Sweeper III

Hi @Mister_Nobody ,

Sorry, I wasn't clear. I'm not picking up the events in Lansweeper, I'm seeing them as part of our general security monitoring processes. 

If possible I want to prevent the scan process from generating SMBv1 connections in the first place. Partly just to reduce the noise in our SIEM system, but also because it makes me nervous that anything is apparently trying to use the very insecure SMBv1 at all.

You have to read about Windows Audit Policy to Enable or Disable Security Events Audit

I know how to enable or disable the audit events, that's why I'm getting them in the first place. I want to see events when something tries to make SMBv1 connections so we can monitor for insecure systems, I just want to know if I can stop Lansweeper from doing so.

We're not using a Workgroup scanning target so I don't think that's relevant.

Mister_Nobody
Honored Sweeper