How to Disable SMB1 Protocol on Windows

What Causes This?

SMB1 is an old Windows file-sharing protocol that was designed long before modern network threats became common. It lacks important security protections found in newer versions like SMB2 and SMB3, which makes it a common target for wormable attacks and lateral movement inside a network. On some PCs, SMB1 is still enabled for compatibility with very old devices, legacy NAS boxes, or outdated software. If you do not actively need it, leaving it enabled increases unnecessary risk.

Common Symptoms

• Windows Features shows SMB 1.0/CIFS File Sharing Support enabled
• Security scans or IT audits flag SMB1 as a vulnerability
• Older network devices only connect when SMB1 is turned on
• You are hardening a PC after malware concerns or network exposure
• File sharing works, but the system still has legacy protocols enabled

How to Fix It Manually

1. Check whether SMB1 is enabled in Windows Features

   • Press Windows + R, type optionalfeatures, and press Enter.
   • In the Windows Features window, scroll down to SMB 1.0/CIFS File Sharing Support.
   • If the box is checked, SMB1 is enabled on your PC.

2. Disable SMB1 from Windows Features

   • Uncheck SMB 1.0/CIFS File Sharing Support.
   • If it expands into sub-items, clear those as well.
   • Click OK and let Windows apply the change.
   • Restart your PC if prompted.

3. Disable SMB1 with PowerShell if Windows Features does not work

   • Click Start, type PowerShell.
   • Right-click Windows PowerShell and choose Run as administrator.
   • Enter this command and press Enter:

     Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

   • Restart the PC after the command completes.

4. Verify that SMB1 is disabled

   • Open PowerShell as administrator again.
   • Run:

     Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

   • Check that the State shows as Disabled.

5. If you use file sharing, make sure SMB2/SMB3 is still available

   • In the same PowerShell window, run:

     Get-SmbServerConfiguration | Select EnableSMB1Protocol, EnableSMB2Protocol

   • Confirm EnableSMB1Protocol is False and EnableSMB2Protocol is True.

6. Test your network shares and older devices

   • Open File Explorer and try accessing any shared folders or NAS devices you normally use.
   • If an older printer, scanner, or NAS stops connecting, that device may depend on SMB1.
   • In that case, update its firmware, switch it to SMB2/SMB3 if supported, or replace it rather than turning SMB1 back on.

7. Optional: Disable SMB1 server support directly

   • If you want to explicitly disable SMB1 on the server side, run this in PowerShell as administrator:

     Set-SmbServerConfiguration -EnableSMB1Protocol $false

   • Type Y to confirm, then restart if needed.

Fix It Automatically with Kudu

Kudu can scan your PC for risky legacy Windows features, including settings that leave old protocols like SMB1 enabled. Instead of hunting through Windows Features and PowerShell output yourself, Kudu helps you identify outdated components and apply safer system optimizations faster.

Download Kudu Free →