3

My apologies if the question is a bit trivial, but I am new to OS X and Mac ecosystem.

In order to be compliant with best practices at work, I have been requested to disable SMB1 protocol client side. The SMB protocol itself is pretty important for our group's workflow since we use it to connect to a shared drive where all of long-term storage and shared files.

The issue is that with that regards, Google was of no help to me - whereas I found instructions to disable SMB altogether, there is nothing relative to SMB1 specifically.

Is this due to the fact that OSX has no support for SMB1 and never had (migrating directly to SMB2/3 from AFP)? If not, what are the steps to follow to disable SMB1 specifically on a client machine?

Some more information: MacOS in question is a Sierra 10.12.3

  • I can't answer your question, but it is better to include in your question which version of macOS/OS X you're using. – N. Cornet Jun 1 '17 at 19:43
  • Sierra 10.12.3. I updated the question for that. – Andrei Kucharavy Jun 1 '17 at 22:10
4

You can't really disable the SMB1 client protocol because SMB2 is backward compatible with SMB1. What you can do, however, is specify that the SMB client only negotiate via SMB 2.x.

To disable SMB1 create an /etc/nsmb.conf (global settings) and/or ~/Library/Preferences/nsmb.conf (user local settings) with the following:

# Configuration file for foo.bar
  [default]
  smb_neg=smb2_only

If you set this in the global location (/etc/nsmb.conf) you will need Admin privileges to modify. If your Macs are "locked down," meaning users don't have Admin privileges, this essentially locks out the user from enabling SMB1 and effectively disabling the SMB1 protocol.

Secondly, what you should do is at a server level disable SMB1 by default. This way, when any client attempts to connect, the Mac client will automatically switch from SMB1 to SMB2/3 as needed. If it's not enabled on the server the client won't matter.

  • Hm. Interesting. So how the Microsoft has "disabled" SMB1 for clients in windows? – Andrei Kucharavy Jun 1 '17 at 22:20
  • 1
    From Microsoft's page, they use the command Set-SmbServerConfiguration -EnableSMB1Protocol $false which is just MS' way of doing the same thing. – Allan Jun 1 '17 at 22:27
  • Glad I could help. – Allan Jun 1 '17 at 22:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .