Disable SMBv1 Protocol on Windows Server to Prevent Ransomware Attacks

SMBv1 is a legacy file-sharing protocol with well-documented, serious vulnerabilities — most infamously the one exploited by the 2017 WannaCry ransomware outbreak. It’s disabled by default on current Windows versions, but older systems, upgraded machines, and anything still relying on legacy network scanners or NAS devices may still have it enabled. Disabling it wherever you can is a baseline security measure, not an optional extra.

Manual Service-Level Commands

For a handful of machines, from an elevated command prompt:

sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi
sc.exe config mrxsmb10 start= disabled

Registry Method

Navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

Add a DWORD named SMB1 with a value of 0, then reboot the machine for the change to take effect.

PowerShell Method (Recommended)

Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol

This fully removes the SMBv1 optional feature rather than just disabling the service, and will prompt you to reboot once complete.

Deploying at Scale

Any of these approaches can be wrapped into a Group Policy startup script or an SCCM configuration baseline/compliance item, so you can both enforce the change and continuously report on any machine where SMBv1 has been re-enabled (deliberately or otherwise) across your estate.

Still Off by Default on Current Windows Server (Updated for 2026)

SMBv1 remains uninstalled by default on all current Windows Server releases (2019 and later), as well as current Windows 10 and 11 — so a fresh, unmodified install shouldn’t need any of the steps above at all. Where you’ll still find it enabled is on older builds, machines upgraded in place from a version where it was present, or systems that had it manually reinstalled for compatibility with legacy scanners, NAS appliances, or backup software. Worth a separate note: CVE-2025-33073 is a distinct SMB privilege-escalation vulnerability unrelated to SMBv1 specifically — disabling SMBv1 doesn’t address it, so don’t treat this guide as covering that issue too.

Resources

• ransomware attacks
• Group Policy