https://github.com/rhymeswithmogul/wannapry-smb1

A proof-of-concept PowerShell script to disable and remove SMB 1.0 from an entire domain: best practice, and extra defense against WannaCry.
https://github.com/rhymeswithmogul/wannapry-smb1

cifs eternalblue smb wannacry wannacrypt windows windows-10 windows-7 windows-8 windows-8-1 windows-desktop windows-server windows-server-2008 windows-server-2012 windows-server-2016 windows-vista windows10 windows7 windows8

Last synced: about 18 hours ago
JSON representation

A proof-of-concept PowerShell script to disable and remove SMB 1.0 from an entire domain: best practice, and extra defense against WannaCry.

• Host: GitHub
• URL: https://github.com/rhymeswithmogul/wannapry-smb1
• Owner: rhymeswithmogul
• License: gpl-3.0
• Created: 2017-05-15T21:33:57.000Z (over 7 years ago)
• Default Branch: master
• Last Pushed: 2017-05-15T22:46:41.000Z (over 7 years ago)
• Last Synced: 2024-09-18T20:08:25.468Z (7 days ago)
• Topics: cifs, eternalblue, smb, wannacry, wannacrypt, windows, windows-10, windows-7, windows-8, windows-8-1, windows-desktop, windows-server, windows-server-2008, windows-server-2012, windows-server-2016, windows-vista, windows10, windows7, windows8
• Language: PowerShell
• Homepage: https://rhymeswithmogul.com/blog/2017-05-17-wannapry-smb1.html
• Size: 18.6 KB
• Stars: 3
• Watchers: 1
• Forks: 1
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# wannapry-smb1

A PowerShell script to disable and remove SMB 1.0 from an entire domain.  If you don't rely on this protocol, [Microsoft's bloggers recommend you remove it](https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-using-smb1/) (though it's still enabled by default).

**Please** don't rely on this to protect your systems from the EternalBlue/WannaCry exploit.  Install [the official Microsoft security patches](https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/).  Use this script only as an extra line of defense.

## How to run

1. Log onto a computer, as a user who has administrative rights to all computers on the domain.

2. Install the Active Directory PowerShell module.

3. Adjust your execution policy as needed with `Set-ExecutionPolicy`.

4. Run this script:  `.\Remove-SMB1FromDomain.ps1`