Disable SMBv1 Protocol: Closing the Ransomware Vulnerability

SMBv1 disabling steps differ depending on which Windows or Windows Server version you’re working with — this breaks down the official Microsoft-documented method for each generation still commonly found in the wild.

Windows 8 / Windows Server 2012 and Later

These versions introduced the Set-SmbServerConfiguration PowerShell cmdlet, which lets you toggle SMBv1, SMBv2, and SMBv3 independently without a reboot. Check current status:

Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol, EnableSMB2Protocol

Disable SMBv1:

Set-SmbServerConfiguration -EnableSMB1Protocol $false

Re-enable if needed:

Set-SmbServerConfiguration -EnableSMB1Protocol $true

No restart is required after running this cmdlet — the change takes effect immediately.

Windows 7 / Windows Server 2008 R2 / Windows Vista / Windows Server 2008

These older versions don’t have the Set-SmbServerConfiguration cmdlet, so SMBv1 is controlled via a registry value instead. Set the following DWORD to 0 to disable it:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
SMB1 (DWORD) = 0

A reboot is required for the registry change to take effect on these older versions. Before disabling SMBv1 anywhere, confirm nothing on your network still depends on it — older network printers, NAS appliances, and some legacy line-of-business applications can still require SMBv1 specifically, and will lose connectivity once it’s turned off.

SMBv1’s Current Default Status (Updated for 2026)

If you’re setting up a new machine rather than hardening an existing one, there’s good news: SMBv1 hasn’t been installed by default since Windows 10 version 1709, and that remains true across every current release in 2026. Windows 11 doesn’t contain the SMBv1 client or server by default on any version (22H2 through the current 24H2/25H2), and Windows Server 2019 onward — including Server 2022 and Server 2025 — ships the same way. On Windows 10 22H2 specifically, Home and Pro editions ship without the SMBv1 server (and the client self-uninstalls after 15 cumulative days of non-use); Enterprise, Education, and Pro for Workstations ship without either component at all. The steps above are still exactly right for the machines that need them — older builds, upgraded-in-place systems that carried SMBv1 forward from a previous install, or anywhere it’s been deliberately re-enabled for a legacy device. Set-SmbServerConfiguration -EnableSMB1Protocol $false remains Microsoft’s current recommended command for turning it off explicitly, and Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol (which requires a restart) fully removes the feature rather than just disabling it. One thing worth flagging so it doesn’t get conflated with the SMBv1 story: CVE-2025-33073, a separate SMB privilege-escalation vulnerability added to CISA’s Known Exploited Vulnerabilities catalog in October 2025, affects the SMB protocol stack generally — it is not an SMBv1-specific issue, and disabling SMBv1 doesn’t address it. Keep normal patching current on top of the SMBv1 hardening covered here.

Resources

• Microsoft