STIGQter STIGQter: STIG Summary: Windows Server 2008 R2 Member Server Security Technical Implementation Guide Version: 1 Release: 30 Benchmark Date: 26 Jul 2019: The Server Message Block (SMB) v1 protocol must be disabled on the SMB client.

DISA Rule

SV-88199r2_rule

Vulnerability Number

V-73523

Group Title

WIN00-000180

Rule Version

WIN00-000180

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 client driver" to "Enabled" with "Disable driver (recommended)" selected for "Configure MrxSmb10 driver".

Configure the policy value for Computer Configuration >> Administrative Templates >> MS Security Guide >> "Configure SMBv1 client (extra setting needed for pre-Win8.1/2012R2)" to "Enabled" with the following three lines of text entered for "Configure LanmanWorkstation Dependencies":
Bowser
MRxSmb20
NSI

The system must be restarted for the changes to take effect.

These policy settings requires the installation of the SecGuide custom templates included with the STIG package. "SecGuide.admx" and "SecGuide.adml" must be copied to the \Windows\PolicyDefinitions and \Windows\PolicyDefinitions\en-US directories respectively.

Check Contents

If the following registry value is not configured as specified, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SYSTEM\CurrentControlSet\Services\mrxsmb10\

Value Name: Start

Type: REG_DWORD
Value: 0x00000004 (4)

If the following registry value includes MRxSmb10, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\

Value Name: DependOnService

Type: REG_MULTI_SZ
Value: Default values after removing MRxSmb10 include the following, which are not a finding:
Bowser
MRxSmb20
NSI

Vulnerability Number

V-73523

Documentable

False

Rule Version

WIN00-000180

Severity Override Guidance

If the following registry value is not configured as specified, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SYSTEM\CurrentControlSet\Services\mrxsmb10\

Value Name: Start

Type: REG_DWORD
Value: 0x00000004 (4)

If the following registry value includes MRxSmb10, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\

Value Name: DependOnService

Type: REG_MULTI_SZ
Value: Default values after removing MRxSmb10 include the following, which are not a finding:
Bowser
MRxSmb20
NSI

Check Content Reference

M

Target Key

1823

Comments