No SMB related entries in HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters?

Question

This microsoft webpage provides guidance, amongst other things, on disabling SMB1 in Windows 2008.

It mentions a registry key HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SMB1.

I haven't yet followed any of those instructions but when I inspect HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters on a W2008 machine there is no entry for SMB1 (or any other entries which appear to relate to SMB).

What is the significance of this? Is it possible to have configured the machine so that it knows nothing about SMB?

Solution

WCry exploits a problem of an unpatched Windows system. The problem is located in the SMBv1 (Server Message Block) implementation.

If the registration key HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\SMB1 (type should be DWORD) is set to 0, it's use is disabled. The default value is 1, i.e. if the key is not present in the registry, it will be treated like it has the value 1.

Comments

[Ryan Bolger]

In other words, SMB1 is on by default you must create the key/value if it doesn't exist and you want to turn it off.