SMB - Server Message Block - Learn System Administration

This article briefly talks about SMB – Server Message Block Protocol, which is basically used for Files, Folder and Printer sharing across networks.

Summary of Contents

What are Protocols?

Click on the link below to find more about Protocols:
https://learnsysadmin.com/index.php/knowledgebase/what-is-a-protocol/

What is SMB – Server Message Block Protocol?

SMB Protocol is a Network File Sharing Protocol in Microsoft Windows. The SMB Protocol enables File, Folder and Printers sharing across networks. The SMB Protocol is a Client-Server based Protocol. Hence, the SMB Protocol needs a Server Service (LanmanServer) to host SMB Shares and a Client Service (LanmanWorkstation) to access SMB Shares.

What are the Ports used by the SMB – Server Message Block Protocol?

You should note that the two main ports that SMB uses are 139 and 445.

What is a SMB Dialect?

An SMB Dialect is the version of the SMB Protocol that the SMB Client and Server use to Exchange Message Packets.

Over the years, the SMB Protocol Message Packets has undergone several upgrades to accommodate new functionalities and hence we have hundreds of Dialects for the SMB Protocol.

Note: The Common Internet File System (CIFS) Protocol is a dialect of SMB.
Here is the link from Microsoft for more information about Common Internet File System (CIFS):
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-cifs/d416ff7c-c536-406e-a951-4f04b2fd1d2b

How to Check Active SMB Connections?

SMB Protocol is a Client-Server Protocol.

Use the following 2 commands to gather SMB Connection Information from the SMB Client(s) and SMB Server(s)

SMB Client Command – Get-SmbConnection

Run the Get-SmbConnection command from an SMB Client to gather all the SMB Connection Information.

The Get-SmbConnection command gathers all the Information about the SMB sessions that are currently active between the SMB-Client and respective SMB-Server(s)

Check All Active SMB connections from an SMB Client to All SMB Server(s)

The following command shows the active SMB connections from the SMB Client to All SMB Servers.

Get-SmbConnection

get-smbconnection_smb-server-message-block

Check Active SMB connections from an SMB Client to Specific SMB Server(s)

Use the following command to view active SMB connections from the SMB Client to Specified SMB Server(s).

Get-SmbConnection -ServerName [ServerName(s)]

SMB Server Command – Get-SmbSession

Run the Get-SmbSession command from an SMB Server to gather all the SMB Connection Information.

The Get-SmbSession command gathers all the Information about the SMB sessions that are currently active between the SMB-Server and respective SMB-Client(s)

Functions or Purpose of SMB – Server Message Block Protocol?

The main purpose of SMB Protocol is File Sharing, but on top of File Sharing, the SMB Protocol provides the following functionalities as well:

SMB Protocol Dialect Negotiation.
Exploring Network to Discover other SMB Protocol Servers, also know as Network Browsing.

How to Enable / Disable SMBv1 and SMBv2/v3?

Enable SMBv1

Set-SmbServerConfiguration -EnableSMB1Protocol $true

Disable SMBv1

Set-SmbServerConfiguration -EnableSMB1Protocol $false

Enable SMBv2/v3

Note: SMBv2 and SMBv3 are both Enabled using the EnableSMB2Protocol argument.
There is no separate setting/argument for SMBv3.

Set-SmbServerConfiguration -EnableSMB2Protocol $true

Disable SMBv2/v3

Note: SMBv2 and SMBv3 are both Disabled using the EnableSMB2Protocol argument.
There is no separate setting/argument for SMBv3.

Set-SmbServerConfiguration -EnableSMB2Protocol $false

What is the Registry Location for SMB – Server Message Block Protocol?

Registry Location for SMB Server Settings

The SMB Protocol settings for SMB Server is at the following location in the Registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

Registry Location for SMB Client Settings

The SMB Protocol settings for SMB Client is at the following location in the Registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters

Microsoft’s documentation on SMB Protocol overview:

Here is the link from Microsoft for more information about SMB Protocol:
https://learn.microsoft.com/en-us/windows/win32/fileio/microsoft-smb-protocol-and-cifs-protocol-overview