-->
Windows Server 2012 introduces new server message block (SMB) file server features. To take advantage of these new features, the SMB client and SMB server must support SMB 3.0. The SMB 2.x protocol was introduced in Windows Server 2008 and in Windows Vista. The SMB 3.0 protocol was introduced in Windows Server 2012 and in Windows 8. The SMB Multichannel feature of SMB 3 allows for having no single point of failure by establishing multiple connections for a single SMB session. This is a feature that is configured automatically. The SMB 3 client automatically looks for additional paths to the SMB server. Microsoft accidentally leaked details of a new wormable vulnerability in the Microsoft Server Message Block 3.1.1 (SMB) protocol during today's Patch Tuesday updates.While the company didn't. Super Mario Bros. X 1.3.0.1 is a massive Mario fangame that blends elements from Super Mario 1, 2, 3 and World.It has many power ups, such as the Ice Flower, Hammer Suit, Tanooki Suit, Kuribo’s shoe, The Billy Gun, and Yoshi.You can also play the game with a friend in the 2 player co-op mode, where the screen seamlessly splits and combines as the players separate and rejoin. Super Mario Bros. 3, New Super Mario Bros. 2, Super Mario Maker and Super Mario Maker 2 (Super Mario Bros. 3 style only) Transforms Mario into Raccoon Mario, letting him fly, glide, and tail whip. Super Mario 3D Land, Super Mario 3D World: Transforms Mario into Tanooki Mario, but only lets him glide and tail whip.
This article describes new features of the Server Message Block (SMB) 3.0 protocol.
Original product version: Windows 10 - all editions, Windows Server 2012 R2
Original KB number: 2709568
Summary
Windows Server introduces new server message block (SMB) file server features. To take advantage of these new features, the SMB client and SMB server must support SMB 3.0.
The SMB 2.x protocol was introduced in Windows Server 2008 and in Windows Vista.
The SMB 3.0 protocol was introduced in Windows Server 2012 and in Windows 8.
New SMB features introduced in the Windows file server
- SMB Transparent Failover
- SMB Scale Out
- SMB Multichannel
- SMB Direct
- SMB Encryption
- VSS for SMB file shares
- SMB Directory Leasing
- SMB PowerShell
SMB Transparent Failover
Both the SMB client and SMB server must support SMB 3.0 to take advantage of the SMB Transparent Failover functionality.
SMB 1.0- and SMB 2.x-capable clients will be able to connect to, and access, shares that are configured to use the Continuously Available property. However, SMB 1.0 and SMB 2.x clients won't benefit from the SMB Transparent Failover feature. If the currently accessed cluster node becomes unavailable, or if the administrator makes administrative changes to the clustered file server, the SMB 1.0 or SMB 2.x client will lose the active SMB session and any open handles to the clustered file server. The user or application on the SMB client computer must take corrective action to reestablish connectivity to the clustered file share.
Note
SMB Transparent Failover is incompatible with volumes enabled for short file name (8.3 file name) support or with compressed files (such as NTFS-compressed files).
SMB Scale Out
Both the SMB client and SMB server must support SMB 3.0 to take advantage of the SMB Scale Out feature.
SMB 1.0 clients don't contain the required client functionality to access SMB scale-out file shares and will receive an Access Denied error message when they try to connect to a scale-out file share.
SMB scale-out file shares are always configured so that the Continuously Available property is set. SMB 2.x clients will be able to connect to SMB scale-out file shares but won't benefit from the SMB Transparent Failover functionality.
SMB Multichannel
Both the SMB client and SMB server must support SMB 3.0 to take advantage of the SMB Multichannel functionality. SMB 1.0 and SMB 2.x clients will use a single SMB connection.
SMB Direct (SMB over Remote Direct Memory Access [RDMA])
SMB Direct is available only on the Windows Server platform and was introduced in Windows Server 2012. SMB Direct Functionality requires that the SMB client and SMB server support SMB 3.0.
SMB Encryption
Both the SMB client and SMB server must support SMB 3.0 to take advantage of the SMB Encryption functionality.
VSS for SMB file shares
Both the SMB client and SMB server must support SMB 3.0 to take advantage of the Volume Shadow Copy Service (VSS) for SMB file shares functionality.
SMB Directory Leasing
Both the SMB client and SMB server must support SMB 3.0 to take advantage of the SMB Directory Leasing functionality.
SMB PowerShell
What Is Smb Direct
SMB PowerShell management cmdlets were introduced in Windows Server 2012 and in Windows 8. Older SMB clients and SMB servers will have to continue using down-level tools for management (for example, Net.exe) and APIs (for example, Win32 APIs).
References
For more information about the common errors you may experience with SMB 3.0, see /troubleshoot/windows-server/networking/error-messages-smb-connections.
-->Applies to: Windows Server 2012 R2, Windows Server 2012, Windows Server 2016
This topic explains the SMB security enhancements in Windows Server 2012 R2, Windows Server 2012, and Windows Server 2016.
SMB Encryption
SMB Encryption provides end-to-end encryption of SMB data and protects data from eavesdropping occurrences on untrusted networks. You can deploy SMB Encryption with minimal effort, but it may require small additional costs for specialized hardware or software. It has no requirements for Internet Protocol security (IPsec) or WAN accelerators. SMB Encryption can be configured on a per share basis or for the entire file server, and it can be enabled for a variety of scenarios where data traverses untrusted networks.
Note
SMB Encryption does not cover security at rest, which is typically handled by BitLocker Drive Encryption.
SMB Encryption should be considered for any scenario in which sensitive data needs to be protected from man-in-the-middle attacks. Possible scenarios include:
- An information worker's sensitive data is moved by using the SMB protocol. SMB Encryption offers an end-to-end privacy and integrity assurance between the file server and the client, regardless of the networks traversed, such as wide area network (WAN) connections that are maintained by non-Microsoft providers.
- SMB 3.0 enables file servers to provide continuously available storage for server applications, such as SQL Server or Hyper-V. Enabling SMB Encryption provides an opportunity to protect that information from snooping attacks. SMB Encryption is simpler to use than the dedicated hardware solutions that are required for most storage area networks (SANs).
Important
You should note that there is a notable performance operating cost with any end-to-end encryption protection when compared to non-encrypted.
Enable SMB Encryption
You can enable SMB Encryption for the entire file server or only for specific file shares. Use one of the following procedures to enable SMB Encryption:
Enable SMB Encryption with Windows PowerShell
To enable SMB Encryption for an individual file share, type the following script on the server:
To enable SMB Encryption for the entire file server, type the following script on the server:
To create a new SMB file share with SMB Encryption enabled, type the following script:
Enable SMB Encryption with Server Manager
- In Server Manager, open File and Storage Services.
- Select Shares to open the Shares management page.
- Right-click the share on which you want to enable SMB Encryption, and then select Properties.
- On the Settings page of the share, select Encrypt data access. Remote file access to this share is encrypted.
Considerations for deploying SMB Encryption
By default, when SMB Encryption is enabled for a file share or server, only SMB 3.0 clients are allowed to access the specified file shares. This enforces the administrator's intent of safeguarding the data for all clients that access the shares. However, in some circumstances, an administrator may want to allow unencrypted access for clients that do not support SMB 3.0 (for example, during a transition period when mixed client operating system versions are being used). To allow unencrypted access for clients that do not support SMB 3.0, type the following script in Windows PowerShell:
The secure dialect negotiation capability described in the next section prevents a man-in-the-middle attack from downgrading a connection from SMB 3.0 to SMB 2.0 (which would use unencrypted access). However, it does not prevent a downgrade to SMB 1.0, which would also result in unencrypted access. To guarantee that SMB 3.0 clients always use SMB Encryption to access encrypted shares, you must disable the SMB 1.0 server. (For instructions, see the section Disabling SMB 1.0.) If the –RejectUnencryptedAccess setting is left at its default setting of $true, only encryption-capable SMB 3.0 clients are allowed to access the file shares (SMB 1.0 clients will also be rejected).
Note
- SMB Encryption uses the Advanced Encryption Standard (AES)-CCM algorithm to encrypt and decrypt the data. AES-CCM also provides data integrity validation (signing) for encrypted file shares, regardless of the SMB signing settings. If you want to enable SMB signing without encryption, you can continue to do this. For more information, see The Basics of SMB Signing.
- You may encounter issues when you attempt to access the file share or server if your organization uses wide area network (WAN) acceleration appliances.
- With a default configuration (where there is no unencrypted access allowed to encrypted file shares), if clients that do not support SMB 3.0 attempt to access an encrypted file share, Event ID 1003 is logged to the Microsoft-Windows-SmbServer/Operational event log, and the client will receive an Access denied error message.
- SMB Encryption and the Encrypting File System (EFS) in the NTFS file system are unrelated, and SMB Encryption does not require or depend on using EFS.
- SMB Encryption and the BitLocker Drive Encryption are unrelated, and SMB Encryption does not require or depend on using BitLocker Drive Encryption.
Secure dialect negotiation
SMB 3.0 is capable of detecting man-in-the-middle attacks that attempt to downgrade the SMB 2.0 or SMB 3.0 protocol or the capabilities that the client and server negotiate. When such an attack is detected by the client or the server, the connection is disconnected and event ID 1005 is logged in the Microsoft-Windows-SmbServer/Operational event log. Secure dialect negotiation cannot detect or prevent downgrades from SMB 2.0 or 3.0 to SMB 1.0. Because of this, and to take advantage of the full capabilities of SMB Encryption, we strongly recommend that you disable the SMB 1.0 server. For more information, see Disabling SMB 1.0.
The secure dialect negotiation capability that is described in the next section prevents a man-in-the-middle attack from downgrading a connection from SMB 3 to SMB 2 (which would use unencrypted access); however, it does not prevent downgrades to SMB 1, which would also result in unencrypted access. For more information on potential issues with earlier non-Windows implementations of SMB, see the Microsoft Knowledge Base.
New signing algorithm
SMB 3.0 uses a more recent encryption algorithm for signing: Advanced Encryption Standard (AES)-cipher-based message authentication code (CMAC). SMB 2.0 used the older HMAC-SHA256 encryption algorithm. AES-CMAC and AES-CCM can significantly accelerate data encryption on most modern CPUs that have AES instruction support. For more information, see The Basics of SMB Signing.
Disabling SMB 1.0
The legacy computer browser service and Remote Administration Protocol features in SMB 1.0 are now separate, and they can be eliminated. These features are still enabled by default, but if you do not have older SMB clients, such as computers running Windows Server 2003 or Windows XP, you can remove the SMB 1.0 features to increase security and potentially reduce patching.
Note
New Smbv3 Vulnerability
SMB 2.0 was introduced in Windows Server 2008 and Windows Vista. Older clients, such as computers running Windows Server 2003 or Windows XP, do not support SMB 2.0; and therefore, they will not be able to access file shares or print shares if the SMB 1.0 server is disabled. In addition, some non-Microsoft SMB clients may not be able to access SMB 2.0 file shares or print shares (for example, printers with “scan-to-share” functionality).
New Smb Emulator
Before you start disabling SMB 1.0, you'll need to find out if your SMB clients are currently connected to the server running SMB 1.0. To do this, enter the following cmdlet in Windows PowerShell:
Note
You should run this script repeatedly over the course of a week (multiple times each day) to build an audit trail. You could also run this as a scheduled task.
To disable SMB 1.0, enter the following script in Windows PowerShell:
New Smb 3 Wii
Note
If an SMB client connection is denied because the server running SMB 1.0 has been disabled, event ID 1001 will be logged in the Microsoft-Windows-SmbServer/Operational event log.
New Smb Wii Iso
More information
Here are some additional resources about SMB and related technologies in Windows Server 2012.