STIGQter: STIG Summary: Microsoft Windows Server 2012/2012 R2 Domain Controller Security Technical Implementation Guide Version: 3 Release: 2 Benchmark Date: 04 May 2021:

The Server Message Block (SMB) v1 protocol must be disabled on the SMB client.

DISA Rule

SV-226051r569184_rule

Vulnerability Number

V-226051

Group Title

SRG-OS-000095-GPOS-00049

Rule Version

WN12-00-000180

Severity

CAT II

CCI(s)

• CCI-000381 - The organization configures the information system to provide only essential capabilities.

Weight

10

Fix Recommendation

Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 client driver" to "Enabled" with "Disable driver (recommended)" selected for "Configure MrxSmb10 driver".

Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 client (extra setting needed for pre-Win8.1/2012R2)" to "Enabled" with the following three lines of text entered for "Configure LanmanWorkstation Dependencies":
Bowser
MRxSmb20
NSI

The system must be restarted for the changes to take effect.

These policy settings requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

Check Contents

This requirement specifically applies to Windows 2012 but can also be used for Windows 2012 R2.

Different methods are available to disable SMBv1 on Windows 2012 R2, if V-73805 is configured on Windows 2012 R2, this is NA.

If the following registry value is not configured as specified, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SYSTEM\CurrentControlSet\Services\mrxsmb10\

Value Name: Start

Type: REG_DWORD
Value: 0x00000004 (4)

If the following registry value includes MRxSmb10, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\

Value Name: DependOnService

Type: REG_MULTI_SZ
Value: Default values after removing MRxSmb10 include the following, which are not a finding:
Bowser
MRxSmb20
NSI

Vulnerability Number

V-226051

Documentable

False

Rule Version

WN12-00-000180

Severity Override Guidance

This requirement specifically applies to Windows 2012 but can also be used for Windows 2012 R2.

Different methods are available to disable SMBv1 on Windows 2012 R2, if V-73805 is configured on Windows 2012 R2, this is NA.

If the following registry value is not configured as specified, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SYSTEM\CurrentControlSet\Services\mrxsmb10\

Value Name: Start

Type: REG_DWORD
Value: 0x00000004 (4)

If the following registry value includes MRxSmb10, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\

Value Name: DependOnService

Type: REG_MULTI_SZ
Value: Default values after removing MRxSmb10 include the following, which are not a finding:
Bowser
MRxSmb20
NSI

Check Content Reference

M

Target Key

4217

Comments