2

I don't use my Windows 10 machine to share or retrieve files, connect to printers, or connect to other hosts via serial port in my home network. Given the history of security flaws in the SMB protocol, the latest being published this week, I would like to disable it. However, the same page that details how to disable it, does not recommend doing so permanently:

We recommend that you do not disable SMBv2 or SMBv3. Disable SMBv2 or SMBv3 only as a temporary troubleshooting measure. Do not leave SMBv2 or SMBv3 disabled.

Can I safely ignore that recommendation? Why is it there? Are there security or other non-filesharing features of leaving it enabled that I'm missing? For example, when the Advanced Troubleshooting page says

In Windows 8, Windows 8.1, Windows 10, Windows Server 2012, and Windows Server 2016, disabling SMBv3 deactivates the following functionality (and also the SMBv2 functionality that's described in the previous list):

  • Transparent Failover - clients reconnect without interruption to cluster nodes during maintenance or failover
  • Scale Out – concurrent access to shared data on all file cluster nodes
  • Multichannel - aggregation of network bandwidth and fault tolerance if multiple paths are available between client and server
  • SMB Direct – adds RDMA networking support for very high performance, with low latency and low CPU utilization
  • Encryption – Provides end-to-end encryption and protects from eavesdropping on untrustworthy networks
  • Directory Leasing - Improves application response times in branch offices through caching
  • Performance Optimizations - optimizations for small random read/write I/O

does that apply to non-filesharing traffic, encryption, and local I/O as well?

0

There is a new Cumulative Update out just this evening (March 12, 2020) that addresses (amongst other things) corrections SMB 3.1.1 .

While I do understand your concern, SMB is much embedded into things Windows 10 does (including all forms of sharing).

So I would recommend keeping Windows 10 up to date rather than permanently disabling SMB .

There is a fairly technical article below above the impact of disabling SMBv3. It is better and easier, in my opinion, to keep Windows 10 up to date

https://duo.com/decipher/microsoft-advisory-warns-of-smbv3-flaw

| improve this answer | |
  • What do you mean by "all forms of sharing"? HTTP? FTP? Uploads to Youtube? I am really not touching anything on my LAN except my router. – Tag Mar 13 at 1:58
  • Even so, at some point you are likely to share something. The security risk you point to is not pervasive and there is already an update for it. It is really your choice, but Microsoft is intent on securing its systems. – John Mar 13 at 2:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.