Enforce Strict SMB Dialect Using Regedit

Enforcing strict Server Message Block (SMB) dialect negotiation policies ensures that Windows systems communicate only over secure, modern versions of the SMB protocol. By restricting the minimum and maximum SMB dialects permitted across your network via the Windows Registry (regedit), administrators can eliminate vulnerabilities associated with legacy protocols and mitigate downgrade attacks.

Prerequisites

• Administrative privileges on the target Windows machine.
• A complete backup of the Windows Registry before making changes.

Step 1: Open the Registry Editor

1. Press Win + R to open the Run dialog.
2. Type regedit and press Enter.
3. Confirm the User Account Control (UAC) prompt by selecting Yes.

Step 2: Navigate to the SMB Configuration Keys

SMB dialect policies can be enforced on both the client side (LanmanWorkstation) and the server side (LanmanServer).

• For SMB Client Policies: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters

• For SMB Server Policies: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

Step 3: Define Dialect Boundaries

To strictly enforce SMB negotiation, define the minimum and maximum SMB2/SMB3 dialects accepted by the system.

1. Select the appropriate Parameters key in the left pane.
2. Right-click the right pane, select New > DWORD (32-bit) Value, and name it MinSMB2Dialect.
3. Right-click the right pane again, select New > DWORD (32-bit) Value, and name it MaxSMB2Dialect.

Set the value data for these entries using the corresponding hexadecimal dialect values below:

Double-click each DWORD value, select Hexadecimal, enter your preferred value (e.g., 00000311 for SMB 3.1.1 exclusively), and click OK.

Step 4: Disable SMBv1 Dialects

To guarantee that negotiation never falls back to insecure SMBv1:

1. In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters, locate or create a DWORD (32-bit) Value named SMB1.
2. Set its value data to 0.
3. Ensure no legacy fallback settings are active under LanmanWorkstation\Parameters.

Step 5: Apply Changes

Registry changes to the SMB subsystem require a service restart or a complete system reboot to take effect.

Open PowerShell or Command Prompt as an Administrator and restart the workstation and server services:

net stop lanmanworkstation /y
net start lanmanworkstation
net stop lanmanserver /y
net start lanmanserver

Alternatively, restart the computer to apply the strict dialect negotiation policy system-wide.