Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / How Windows 11 Is Quietly Retiring Enterprise SMB1
Transcript
- Lucas: Microsoft has been trying to kill SMB1 for nearly a decade. But Windows 11 is the first version where they've made it truly painful to keep alive. Luna: And by painful you mean… it's not even installed by default anymore, right? Lucas: Exactly. On Windows 10, SMB1 was still a Windows Feature you could turn on with a checkbox. On Windows 11, it's gone from the default install. You have to go into 'Optional Features' — and even then, Microsoft warns you three times that you're enabling a deprecated, dangerous protocol. Luna: But I bet a lot of enterprises still have it running — not because they want it, but because some old printer or file server breaks without it. Lucas: That's the whole story right there. SMB1 is nearly 40 years old. It was the default for Windows networking from the 1990s through Windows 7. And it's the protocol that WannaCry and NotPetya used to spread laterally. Microsoft has been shouting 'disable this' since 2017. But enterprises are full of devices that never got updated. Luna: So what does an IT team actually do when they upgrade a site to Windows 11 and suddenly the accounting department's network scanner stops working? Lucas: First, they need to figure out what's actually using SMB1. The old approach was to just flip the switch in Group Policy and see what breaks. But that's a recipe for a frantic Monday morning. There are better tools now — Microsoft provides PowerShell cmdlets like 'Get-SmbConnection' and 'Get-SmbServerConfiguration' that can scan a network for SMB1 usage without turning it off. Luna: So you audit first, then disable. That sounds obvious, but I've definitely worked with teams that went straight to disabling and then spent weeks firefighting. Lucas: Right. And the tricky part isn't the Windows clients — it's the appliances. Medical imaging devices, industrial controllers, old NAS boxes, even some building management systems. They run embedded versions of Windows or proprietary OSes that only speak SMB1. One mid-size manufacturer I talked to spent six months replacing a single HVAC controller that was running Windows XP Embedded — just because it was the only thing on their network still demanding SMB1. Luna: Six months for one controller. That's not a flip a switch migration. Lucas: No, and that's why Microsoft's approach with Windows 11 is smart but also a little ruthless. They're not disabling SMB1 on existing upgrades — if you upgrade from Windows 10 to Windows 11, SMB1 stays enabled if it was already on. But any fresh install of Windows 11 has it off by default. So over time, as machines get replaced, the protocol naturally dies. The pressure is on IT to either update those old devices or isolate them on a separate network segment. Luna: I remember reading that Microsoft also removed the SMB1 driver from the Windows 11 kernel entirely in some insider builds. Is that still the plan? Lucas: They've been testing that. In certain Windows 11 preview builds from earlier this year, the SMB1 driver — srv2.sys — was completely absent. That means even if you try to install the feature, it won't work. But as of the current stable release, the driver is still present if you manually enable it. I think Microsoft is waiting for the enterprise feedback to settle before taking that final step. Luna: Makes sense. They don't want to strand hospitals or factories with no migration path. Lucas: Exactly. And the good news is that most modern devices — anything manufactured after 2015 or so — support SMB2 or SMB3. The real problem is the long tail of embedded systems. And those aren't really Microsoft's problem — they're third-party vendors who never updated their software. Luna: Speaking of third-party vendors — we should mention that we keep this show completely ad-free. No sponsors, no product placements. If today's tech conversation gave you something usable, and you'd like to support that choice, the link is buy me a coffee dot com slash fexingo. Lucas: Yeah, it's a small way to keep this independent. And we appreciate everyone who chips in. So back to SMB1 — what about the detection side? Any tools you'd recommend? Luna: I've used the Microsoft SMB1 Troubleshooting Guide — which is actually a PowerShell script that logs all SMB1 connections on a network. And there's also a third-party tool called 'SMB1 Scanner' from some security researchers. But the built-in PowerShell approach is usually enough. Lucas: Yeah, the Get-SmbConnection cmdlet shows you active sessions using SMB1. And you can also check the event log — Event ID 1000 under microsoft windows smbclient/Connectivity will log any SMB1 connection attempt. That's a great way to find silent dependencies. Luna: So for an IT manager listening: the playbook is basically audit with PowerShell, then use Group Policy to disable SMB1 on clients, but keep a whitelist for critical legacy devices? Lucas: Close. I'd say audit first, then use Group Policy to disable SMB1 on all Windows clients, but before you do that, identify any devices that genuinely need it and either replace them, upgrade their firmware, or segment them onto a separate VLAN that still allows SMB1. Because once you disable SMB1 on a Windows 11 machine, it's gone — there's no fallback to SMB2 if the server only speaks SMB1. Luna: And that's the key point: SMB1 is not a fallback protocol. If the client has it disabled, and the server requires it, the connection simply fails. No graceful degradation. Lucas: Right. And that's why Microsoft is taking it slow with the kernel removal. They want to give enterprises time to clean up. But the clock is ticking — I'd be surprised if Windows 12 or the next major Windows 11 update doesn't drop the driver entirely. Luna: What about SMB1 over the internet? I remember that was a huge security risk — people exposing file shares directly. Lucas: That's been blocked since Windows 10 Fall Creators Update. By default, Windows 10 and 11 will not allow SMB1 connections over the internet — they require signing and encryption for remote connections. But the local network is where most attacks happen. WannaCry spread inside corporate LANs because SMB1 was enabled on every workstation. Luna: So the real lesson is: if you're still running SMB1 anywhere in your enterprise, you have a ticking time bomb. Not because Microsoft is going to shut it off tomorrow, but because the next ransomware will almost certainly try that door first. Lucas: Exactly. And the beauty of Windows 11's approach is that it forces you to make that decision explicitly. You can't just leave it on by accident anymore. Every fresh install is clean. Every upgrade is a reminder. Over the next 12 to 18 months, the protocol will just naturally fade away in most organizations. Luna: Unless you have that HVAC controller from 2006. Lucas: Unless you have that HVAC controller. But even then — there are workarounds. You can put it on an isolated subnet with a dedicated file server that still runs SMB1, and block all other traffic. It's not ideal, but it's better than having SMB1 enabled across your entire domain. Luna: Good point. And for listeners who want to check their own environment, the PowerShell command is Get-SmbConnection | Where-Object Dialect -eq '2.0.2' — that will show you any connections still using SMB1. Lucas: Actually, the dialect string for SMB1 is '2.0.2' — that's the older dialect. SMB 2.0 uses '2.0.0', SMB 2.1 uses '2.1.0', SMB 3.0 uses '3.0.0'. So filtering by '2.0.2' gets you the legacy connections. Luna: Right, thanks for the correction. So bottom line: Windows 11 is the beginning of the end for SMB1. IT teams should start their inventory now, because the driver removal is coming. Lucas: And when it does, that HVAC controller won't negotiate. It will just fail. So plan ahead, audit early, and if you can — replace those legacy devices. They're not just a compatibility headache, they're a security liability. Luna: Great episode. Next time, we'll look at how Windows 11 is handling the transition to SMB over QUIC — that's the new remote access protocol. Lucas: Looking forward to it. Thanks, Luna. Luna: Thanks, Lucas.