Tag: PowerShell

Stop using the insecure SMBv1/SMB1 protocol

The recent WannaCry ransomware outbreak spread because of a vulnerability in one of the internet’s most ancient networking protocols, Server Message Block version 1 (aka SMBv1 / SMB 1).

Barry Feigenbaum originally designed SMB at IBM. Microsoft has made considerable modifications to the most commonly used version. Microsoft merged the SMB protocol with the LAN Manager product.

The original SMB1 protocol is nearly 30 years old, and like much of the software made in the 80’s, it was designed for the world that no longer exists. The world without malicious actors, without vast sets of important data, without near-universal computer usage. Frankly, its naivete is staggering when viewed through modern eyes.

The Server Message Block, or SMB, protocol is a file sharing protocol that allows operating systems and applications to read and write data to a system. It also allows a system to request services from a server.

This is the protocol mainly used for providing shared access to files, printers, and serial ports and miscellaneous communications between nodes on a network.

In computer networkingServer Message Block (SMB), one version of which was also known as Common Internet File System (CIFS) operates as an application-layer network protocol.

There have been numerous vulnerabilities tied to the use of Windows SMB v1, including remote code execution and denial-of-service exploits. These two vulnerabilities can leave a system crippled, or allow attackers to compromise a system using this vulnerable protocol.

Protocol Version Windows OS
SMB 1 Windows 2000, Windows 2003, Windows XP
SMB 2 Windows Server 2008 and Windows Vista SP1
SMB 2.1 Windows Server 2008 R2 and Windows 7
SMB 3.0 Windows Server 2012 and Windows 8
SMB 3.0.2 Windows Server 2012 R2 and Windows 8.1
SMB 3.1.1 Windows Server 2016 and Windows 10

SMB 1 protocol permits man-in-the-middle exploits and it “isn’t safe” to use. An attacker can use SMB 2 to pull information from the insecure SMB 1 protocol if it exists in a network.

The nasty bit is that no matter how you secure all these things if 
your clients use SMB1, then a man-in-the-middle can tell your client
to ignore all the above. All they need to do is block SMB2+ on 
themselves and answer to your server's name or IP.Your client will 
happily derp away on SMB1 and share all its darkest secrets unless
you required encryption on that share to prevent SMB1 in the first 
place. This is not theoretical-- we've seen it.

                 ~ Ned Pyle, a Principal Program Manager, Microsoft

 

How to remove SMB V1 /SMB 1 in Windows OS?

Windows 8.1 and Windows 10:

Method-1: Open Control Panel (just start typing Control in the search box to find its shortcut quickly). Click Programs, and then click Turn Windows features on or off (under the Programs heading). Or

Start –> Run –> Type appwiz.cpl –> press enter –> Click Turn Windows features on or off

Clear the check box for SMB 1.0/CIFS File Sharing Support, as shown here. That’s it; you’re protected.

SMB1

Method-2:  open a Windows PowerShell prompt with administrative privileges. In the Windows 10 Creators Update, version 1703, right-click the Start button and choose Windows PowerShell (Admin) from the Quick Link menu.) If you’re running an earlier Windows 10 version, enter Windows PowerShell in the search box, then right-click the Windows PowerShell shortcut and click Run as administrator. From that elevated PowerShell prompt, type the following command:

Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol

Press Enter and you’re done.

Note You must restart the computer after you make these changes.

Windows 2012 R2, and Windows Server 2016:

Method-1: Launch Server Manager from Command Line.

Press the Windows key + R to open the Run box, or open the Command Prompt. Type ServerManager and press Enter.

Run

Or Launch Server Manager from Taskbar

Task bar

On Server, the Server Manager approach:

image495

Method-2: On Server, the PowerShell approach (Remove-WindowsFeature FS-SMB1):

Remove-WindowsFeature Name FS-SMB1

image496

On legacy operating systems:

When using operating systems older than Windows 8.1 and Windows Server 2012 R2, you can’t remove SMB1 – but you can disable it.

Windows 8 and Windows Server 2012:

Windows 8 and Windows Server 2012 introduce the new Set-SMBServerConfiguration Windows PowerShell cmdlet. The cmdlet enables you to enable or disable the SMBv1, SMBv2, and SMBv3 protocols on the server component. (A cmdlet is a lightweight command that is used in the Windows PowerShell environment.)

  • To disable SMBv1 on the SMB server, run the following cmdlet:

Set-SmbServerConfiguration -EnableSMB1Protocol $false

  •  To enable SMBv1 on the SMB server, run the following cmdlet:

Set-SmbServerConfiguration -EnableSMB1Protocol $true

 Windows Server 2008 R2 and Windows Server 2008:

To enable or disable SMB protocols on an SMB Server that is running Windows 7, Windows Server 2008 R2, Windows Vista, or Windows Server 2008, use Windows PowerShell or Registry Editor.

Windows PowerShell 2.0 or a later version of PowerShell

  • To disable SMBv1 on the SMB server, run the following cmdlet:

Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters” SMB1 -Type DWORD -Value 0 -Force

  • To enable SMBv1 on the SMB server, run the following cmdlet:

Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters” SMB1 -Type DWORD -Value 1 -Force

 Note You must restart the computer after you make these changes.

Registry Editor:

Important

This article contains information about how to modify the registry. Make sure that you back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to backup, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:  322756 How to backup and restore the registry in Windows

To enable or disable SMBv1 on the SMB server, configure the following registry key:

Registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\ParametersRegistry entry: SMB1
REG_DWORD: 0 = Disabled
REG_DWORD: 1 = Enabled
Default: 1 = Enabled

Windows Vista, Windows 7, and Windows 8:

  • To disable SMBv1 on the SMB client, run the following commands:

sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi
sc.exe config mrxsmb10 start= disabled

  • To enable SMBv1 on the SMB client, run the following commands:

sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi
sc.exe config mrxsmb10 start= auto

Source: Microsoftzdnettechnet.microsoftredmondmagtop-password, techtargetwindowsitpro

Windows 10 Creators Update: Coming April 11

The Creators Update (formerly known as  “Redstone 2”) is just another update for Windows 10. The Creators Update is more significant and includes new features and changes to improve the user experience.

Why is called the Creators Update ?

Microsoft has chosen the “Creators Update” name because according to the company the new update helps everyone to be a creator. However, the name has a more marketing purpose, as using a friendly name it’s easier to sell than using numbers. However, for more technical users “Windows 10 version 1703” will make more sense.

Microsoft has confirmed in a blog post that the Windows 10 Creators Update (known as 1703) will arrive on 11th April 2017. Microsoft will likely roll out the Creators Update gradually over a few months. The timeline in which your PC will receive the update depends on the device type. The same day (11th April 2017) it will retire Windows Vista.

Capture

The Creators Update will be a free upgrade for devices that are running on Windows 10 already.

The new update is part of the new Windows as a Service (WaaS) model, which means that instead of getting a brand-new version of the OS (e.g., Windows Vista and Windows 7) around every three years, you will get roughly two incremental updates with new features and improvements every year. In this new servicing model, the work to improve Windows 10 is an ongoing process, and it’s never consider a final product.

What Is New in The Creators Update?

  1. Privacy: If you’re upgrading from a previous version of Windows, or from one of the older versions of Windows 10, you’ll get a prompt when the upgrade completes, asking you to adjust all your new Windows 10 privacy settings. If you’re setting up a new Windows 10 PC with the Creators Update, there’s a new dedicated privacy settings screen that Microsoft rebuilt that gives detailed explanations for what each setting does, and how it benefits the user or Microsoft.privacy-2-1024x812

2. Windows Defender:  

Windows 10 now includes a new Windows Defender dashboard that uses the same design language we’re now seeing on the Store, and it’s  known as Windows Defender Security Center.

Windows Defender

Alongside the new name, the dashboard is the new place to control malware protection, device performance and health, firewall and network protection, and family options.

3. Application Installation Control: You now have the option to control what type of apps are allowed to install on your PC. This setting is available by going to Settings > Apps > Apps & features. You can choose to only allow installation of Store apps, choose to be warned when installing a non-Store app but allow their installation, or choose to allow installation of apps from anywhere.

 4. Dynamic Lock: Windows 10 can now automatically lock your PC when you step away. Pair a Bluetooth-enabled phone and enable Dynamic Lock under Settings > Accounts > Sign-in Options. If you step away from your PC for 30 seconds and take the phone with you, Windows will automatically lock your PC. Microsoft’s blog post says this is for “Bluetooth phones”, but it appears it may work with other devices, like Bluetooth-enabled wristbands.

5. Night Light: Staring at a screen all day can be tiring on the eyes, and at night it can actually trick the brain into thinking it’s still taking in daylight. This happens due to screens emitting something called a blue light. Because of this, users who use their PCs late at night can sometimes find it much harder to go to sleep. To get around this, Microsoft has built into Windows 10 a new function that gives the screen a warm tint during the evenings, which as a result is easier on the eyes and doesn’t confuse the brain into thinking it’s still day, meaning you can get to sleep easier when you’re done.

Night Light

6. Start Menu: Easily pin or unpin apps to the Start menu by dragging and dropping an app from list, or by right-clicking and selecting a “Pin to Start”. After that, you can click and drag to move apps around or right-click the app to resize.

Start

7. Change the tile colors. Head to Settings > Personalization > Colors to choose a new color for all your tiles.

Colours.gif

 8. Microsoft Edge: Microsoft Edge is faster and safer with better browsing and entertainment.

Tab preview bar: It’s easy to lose track of what’s in your tabs, especially when you have many tabs from the same site, with similar titles and icons. Tab preview bar allows you to easily glance at a visual preview of every tab you have open without leaving your page.

Set these tabs aside: It’s a headache to keep all your tabs organized, and to pick up where you left off. Sometimes you just need to set everything aside and start from a clean slate. Microsoft added two new buttons next to your tabs in Microsoft Edge to help you quickly manage all your tabs without losing your flow.

Flash Click-to-Run: Microsoft Edge will now block untrusted Flash content by default until the user explicitly chooses to play it. This means better security, stability, and performance for you, while preserving the option to run Flash when you choose.

Longer battery life: When streaming HD video, Microsoft Edge lasts up to 69% longer than Firefox and 45% longer than Chrome.

The Microsoft Edge browser will have advanced tab management and support for e-books in the Windows Store. Edge acts as both a web browser and book reader with the Creators Update.

The Microsoft Edge is the first browser can play Netflix movies and TV shows in 4K Ultra HD resolution.

9.Game Mode: When the Game Mode is enabled, it’ll optimize your computer’s processor and graphics card to prioritize a game you have open. So, whatever software is in the background will still be running, but your computer will divert fewer resources to them. The end result is a much smoother gaming experience. Depending on your hardware setup, Game Mode may actually boost the overall performance of the game, the goal is consistency, so no matter what’s running in the background, it’ll be a smooth experience.

The concepts behind Game Mode are already available on Xbox One, which gives games priority access to system resources.

The Creators Update has a “screen time limits” feature so parents can manage how much time kids are spending playing games. With screen time limits, parents can set a daily time allowance for each child and your Xbox One or Windows 10 PC will automatically sign them out when time is up.

The Creators Update also has built-in game broadcasting for Windows 10 and the Xbox One via Beam. Soon Acer, ASUS, Dell, HP and Lenovo will ship Windows Mixed Reality- enabled headsets.

10. Paint 3D: With the new Paint 3D app in the Creators Update, it’s simple to create 3D objects from scratch, easily changing colors, stamping textures, or turning a 2D picture into a 3D work of art. Remix3D.com offers pre-made 3D art in a growing online library for your use or you can share your own creation with this creative community. This app also supports 3D printing.

3d final

11. Action Center: The Action Center is a welcome addition to the Windows operating system. Finally, users can track events and won’t miss anything important.

Notofication

(Note that this icon will turn white if you have any unread notifications.)

Some of the quick actions have been refreshed, but the big change is sliders for both volume and screen brightness. You can adjust these in smaller increments than the 25 percent levels that are earlier offered as quick actions.

Action Center

Windows Store now shows download progress inside of the Action Center.

12. Cortana: Microsoft has updated the “out-of-box experience”, when booting a new PC for the first time or clean installing Windows 10, Microsoft give it a redesign, they added additional steps, and above all introduced Cortana integration along with voice commands.

You’ll now get a full-screen experience of Cortana when your computer idles for at least 10 seconds. Also, there is a new pick up where you left off in Cortana feature, which allows you resume working on a file, app, or web page on another device.

CortanaJPG

13. Windows Update: Microsoft calls this new Windows Update system the “Unified Update Platform,” and it is now the same system used across both PC and Mobile devices powered by Windows. Windows Update will no longer have to download a full version of Windows whenever a major update is available. Instead, it’ll only download the files needed to apply the update, meaning major updates can be up to 35 percent smaller when downloaded via Windows Update. This means less data use on your internet provider and faster downloads overall.

You can now pause updates for up to 35 days. You’ll find this option at Settings > Update & Security > Windows Update > Advanced Options > Pause Updates. This setting is only available on the Professional, Enterprise, and Education editions of Windows 10—not Windows 10 Home.

Update

Users will be able to schedule when to install an update. And “active hours” can be set for when a reboot should not take place.

You can now set up to 18 hours of the day as your Active Hours, so Windows 10 won’t restart for updates during those hours. Previously, the maximum was 12 hours. Windows Update also attempts to detect whether the PC display is being used for something -projecting, for example -before automatically restarting the PC.

14. Mini View: Windows 10 Creators Update has a new feature called Mini View.It’s limited to the Movies & TV. and Skype Preview apps for now.This feature lets you pin the app to a corner of your screen on top of all other apps. Think picture-in-picture mode that lets you continue watching a movie while you work.

15. Location Bar in the Registry Editor: The Registry Editor finally includes a location bar, allowing you to easily copy-paste addresses rather than being forced to painstakingly navigate to them.

Regedit

16. PowerShell Is the Default: PowerShell is now the default shell. When you right-click the Start button, you’ll see options to open PowerShell instead of Command Prompt. When you hold Shift and right-click in a folder or click the File menu in File Explorer, you’ll see an option to open PowerShell instead of Command Prompt. Despite this, Microsoft insists that the Command Prompt is not dead and will not be removed from Windows until almost no one uses it.

17. Quick Virtual Machine Creation: If you’re using Hyper-V to create virtual machines, you’ll see a “Quick Create” button in Hyper-V manager. This is a simplified wizard that allows you to create a new virtual machine in just a few clicks.

18. New Screenshot Hotkey: Windows 10 gains yet another screenshot tool. Press Windows+Shift+S to capture a region of your screen and copy it to your clipboard. This feature was originally part of OneNote 2016, but has been added to Windows itself.

19. Storage Sense: Windows 10 can now automatically free up disk space, although this feature is off by default. Enable the Storage Sense feature under Settings > System > Storage and Windows will automatically erase your temporary files and empty your recycle bin to free up space.

20. Windows Ink:  In the pen support front, Windows Ink will be bringing a number of improvements, including a new protractor tool for Sketchpad and Screen sketch.

Windows Ink

On Screen Sketch and Sketchpad, you’ll get a preview of color and width of the ink as you make your choices in the pen, pencil, and highlighter flyouts. And Screen Sketch gets a new Resume previous option to recover previous sketches.

Sticky Notes gets updated as well with support for address, time, phone number, stock symbols, and flight information when using digital ink.

Windows 10 Creators Update – Official Release Demo

Source: PUREinfoTech, Forbes, How-To Geek, Windows Central, Business Insider, Microsoft, Windows Blog