SMBv1 From Scan Servers?
We've got SMBv1 Auditing enabled on our domain and SMBv1 disabled on everything including the Lansweeper scan servers. We're seeing event log entries on our DCs from both of our scan servers like the one below. Nothing else is generating these events...