SMBv1 disabled

[stiwa]

Hi,
is it possible to create a report whether the SMBv1 feature is installed or not on Windows 2012 R2 an up servers?

[joe_user]

If a features is "installed," does that mean its active?

[Esben_D · Accepted solution]

You can use this built-in report "Windows: Installed Windows features" and add the following criteria:

• For tsysOS.OSname: LIKE 'Win 20%'
  
• For tblFeatureUni.featureName: LIKE 'SMB%'

You can find a copy of the built-in report here: https://m.lansweeper.com/forum/yaf_postst15171_Windows--Installed-Windows-features--Built-in.aspx#post51421

For detecting if SMB is active or not I found some relevant info here: https://www.reddit.com/r/sysadmin/comments/6b3bmw/is_there_a_fast_way_to_verify_that_smbv1_is/?st=jc67fad9&sh=3ad3bde2

It states that the registry key HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters has a value called SMB1 which, if enabled is set to 1, if disabled is set to 0.

You add that registry value for scanning and use this sample report to report on it: https://www.lansweeper.com/Forum/yaf_postst10451_Value-of-a-value-name-submitted-for-custom-registry-scanning.aspx#post39295