Protect Yourself from the WannaCry(pt) Ransomware

Well, this has been an exciting weekend for IT guys around the world. Two IT Security folks can say that they saved the world and a lot of people in IT had no weekend. The attack was shut down before it encrypted the world, but there’s a good chance the attack will just be changed and start over. So what can you do to keep your system and data from being compromised by this most recent cyberware attack? If you’ve patched everything up already, or don’t know if you’re patched or vulnerable to this attack (or you just don’t want to deal with Windows updates right now), and you want to be absolutely positive that your computer won’t be affected, disable SMBv1! Like, seriously. You don’t need it. Unless you’re a Luddite.

There are some environments that may still need it (Anyone still using Windows XP and server 2003, antiquated management software, or PoS NAS devices), so if you have a Windows Server environment, run

Set-SmbServerConfiguration –AuditSmb1Access $true

in PowerShell for a bit and watch the SMBServer audit logs for failures.

To disable SMBv1 Server capabilities on your devices, do the following:

Server 2012 and Later

1. Open Powershell (Click start and enter Powershell in the search bar to open it if you don’t know how to get to it)
2. Type in this and hit Enter: Remove-WindowsFeature FS-SMB1
3. Wait a bit for the uninstall process to finish.
4. Voila! WannaCry can’t spread to this system anymore.

Windows 7, Server 2008/2008R2

1. Open Powershell (Click start and enter Powershell in the search bar to open it if you don’t know how to get to it)
2. Type in this (everything on the same line) and hit Enter: Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters” SMB1 -Type DWORD -Value 0 -Force
3. Wait a bit for the command to complete.
4. Voila! WannaCry can’t spread to this system anymore.

Windows 8.1/10

1. Open Powershell (Click start and enter Powershell in the search bar to open it if you don’t know how to get to it)
2. Type in this and hit Enter: Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol
3. Wait a bit for the uninstall process to finish.
4. Voila! WannaCry can’t spread to this system anymore.

If you’re using Windows Vista…I am so so sorry…But the Windows 7/8 instructions should still work for you.

If you still use Windows XP…stop it. And you’re just going to have to get the patch that MS released for this vulnerability.

An additional step you may want to take is to disable SMBv1’s *client* capabilities on your systems. Running the two commands below (on one each line) will do this for you. This isn’t completely necessary, since the client can’t connect to other systems unless they support SMBv1, so if the SMBv1 server component is disabled above, the SMBv1 client can’t do anything. But, if you want to disable the client piece as well, enter the following commands: