Blocked SMB1 logon attempts from scan server

[TomaszHolderny]

We get constant notifications on our QNAP system about blocked SMB1 logon attempt from Lansweeper scan server.

We don't use Workgroup scanning target - only AD and IP Range.

How to stop scan server from using SMB1 protocol?

[TomaszHolderny]

I have SMB1 disabled on all my servers, including the one hosting Lansweeper Scan Server. Yet i still get smb1 login errors in audit logs.

[Obi_1_Cinobi]

Hello there!

We would recommend opening a support case for further assistance: https://www.lansweeper.com/contact/contact-support/

[TomaszHolderny]

So if i understand correctly Lansweeper is using deprecated SMB1 protocol with stored credentials to scan the network (even if i don't have workgroup scan target set up) and there is no way to disable it? Isn't it a security risk?

[Obi_1_Cinobi]

Hello there!

Disabling the SMBv1 protocol should be done on the relevant systems/networks and falls outside the scope of Lansweeper support. But Lansweeper will indeed try all available protocols.

[Obi_1_Cinobi]

Hello there!

Lansweeper doesn't require having SMBv1 enabled to function, but within Lansweeper, there is no configuration option to tell Lansweeper not to try this protocol. As you correctly hinted, due to their reliance on the old SMB1 protocol, Workgroup scanning targets are marked as deprecated.