File Server / DFS¶

# Read SMB server configuration
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"

# Optimize SMB server for a dedicated file server role
$smbPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"

# Set server profile to "maximize throughput for file sharing"
Set-ItemProperty -Path $smbPath -Name "Size" -Value 3 -Type DWord

# Increase maximum worker items for heavy workloads
Set-ItemProperty -Path $smbPath -Name "MaxWorkItems" -Value 8192 -Type DWord

# Increase max multiplexed requests per client
Set-ItemProperty -Path $smbPath -Name "MaxMpxCt" -Value 255 -Type DWord

# Restart the Server service to apply changes
Restart-Service LanmanServer -Force

# Disable automatic administrative shares
$smbPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
Set-ItemProperty -Path $smbPath -Name "AutoShareServer" -Value 0 -Type DWord

# Read SMB client configuration
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters"

# Harden SMB client configuration
$clientPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters"

# Require SMB signing on all connections
Set-ItemProperty -Path $clientPath -Name "RequireSecuritySignature" -Value 1 -Type DWord

# Disable plain text passwords (should already be 0)
Set-ItemProperty -Path $clientPath -Name "EnablePlainTextPassword" -Value 0 -Type DWord

# Disable insecure guest authentication (prevents fallback to guest on misconfigured shares)
Set-ItemProperty -Path $clientPath -Name "AllowInsecureGuestAuth" -Value 0 -Type DWord

# Compare SMB signing settings between server and client
$serverPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
$clientPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters"

$server = Get-ItemProperty $serverPath
$client = Get-ItemProperty $clientPath

[PSCustomObject]@{
    Component = "Server (LanmanServer)"
    EnableSigning  = $server.EnableSecuritySignature
    RequireSigning = $server.RequireSecuritySignature
},
[PSCustomObject]@{
    Component = "Client (LanmanWorkstation)"
    EnableSigning  = $client.EnableSecuritySignature
    RequireSigning = $client.RequireSecuritySignature
} | Format-Table -AutoSize

# Check DFS service configuration
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\Dfs" -ErrorAction SilentlyContinue |
    Select-Object DisplayName, ImagePath, Start

# Read DFS parameters
$dfsPath = "HKLM\SYSTEM\CurrentControlSet\Services\Dfs\Parameters"
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\Dfs\Parameters" -ErrorAction SilentlyContinue

# Check DFS-R service and parameters
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\DFSR" -ErrorAction SilentlyContinue |
    Select-Object DisplayName, ImagePath, Start

Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\DFSR\Parameters" -ErrorAction SilentlyContinue

# Check DFS referral cache on a client
$dfsClientPath = "HKLM:\SOFTWARE\Microsoft\Dfs"
Get-ChildItem $dfsClientPath -Recurse -ErrorAction SilentlyContinue

# Force a DFS referral refresh
dfsutil /pktflush
dfsutil /spcflush

# Check FSRM service status
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\SrmSvc" -ErrorAction SilentlyContinue |
    Select-Object DisplayName, Start

# Check FSRM configuration in the registry
$fsrmPath = "HKLM:\SOFTWARE\Microsoft\FileServerResourceManager"
Get-ItemProperty $fsrmPath -ErrorAction SilentlyContinue

# Check VSS service configuration
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\VSS" -ErrorAction SilentlyContinue |
    Select-Object DisplayName, ImagePath, Start

# Check VolSnap driver (kernel-level shadow copy management)
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\VolSnap" -ErrorAction SilentlyContinue |
    Select-Object DisplayName, ImagePath, Start

# List current shadow copies and their sizes
vssadmin list shadowstorage

# Set maximum shadow copy storage to 20% of volume D:
vssadmin resize shadowstorage /For=D: /On=D: /MaxSize=20%

# Check CSC (Client-Side Caching) service
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\CscService" -ErrorAction SilentlyContinue |
    Select-Object DisplayName, Start

# Check Offline Files policy configuration
$netCachePath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\NetCache"
Get-ItemProperty $netCachePath -ErrorAction SilentlyContinue

# Disable Offline Files globally on a server
$netCachePath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\NetCache"
Set-ItemProperty -Path $netCachePath -Name "Enabled" -Value 0 -Type DWord

# Check BranchCache service status
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\PeerDistSvc" -ErrorAction SilentlyContinue |
    Select-Object DisplayName, Start

# Check BranchCache configuration
Get-BCStatus | Select-Object -ExpandProperty ClientConfiguration

# Enable BranchCache for file server role
$bcPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PeerDist\Service\Configuration"

if (-not (Test-Path $bcPath)) {
    New-Item -Path $bcPath -Force | Out-Null
}

# Enable the BranchCache hash publication service
Enable-BCHostedServer -RegisterSCP

# Enable BranchCache on a specific SMB share
Set-SmbShare -Name "SharedData" -CachingMode BranchCache -Force

# Audit SMB signing configuration
$serverPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
$clientPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters"

[PSCustomObject]@{
    Side = "Server"
    EnableSigning = (Get-ItemProperty $serverPath).EnableSecuritySignature
    RequireSigning = (Get-ItemProperty $serverPath).RequireSecuritySignature
},
[PSCustomObject]@{
    Side = "Client"
    EnableSigning = (Get-ItemProperty $clientPath).EnableSecuritySignature
    RequireSigning = (Get-ItemProperty $clientPath).RequireSecuritySignature
} | Format-Table -AutoSize

# Enforce SMB signing on both server and client
$serverPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
$clientPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters"

# Server side
Set-ItemProperty -Path $serverPath -Name "EnableSecuritySignature" -Value 1 -Type DWord
Set-ItemProperty -Path $serverPath -Name "RequireSecuritySignature" -Value 1 -Type DWord

# Client side
Set-ItemProperty -Path $clientPath -Name "EnableSecuritySignature" -Value 1 -Type DWord
Set-ItemProperty -Path $clientPath -Name "RequireSecuritySignature" -Value 1 -Type DWord

# Check if SMB encryption is enabled server-wide
Get-SmbServerConfiguration | Select-Object EncryptData, RejectUnencryptedAccess

# Enable SMB encryption server-wide
Set-SmbServerConfiguration -EncryptData $true -Force

# Enable encryption on a specific share only
Set-SmbShare -Name "ConfidentialData" -EncryptData $true -Force

# Check if SMBv1 is enabled
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol

# Disable SMBv1 server-side
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force

# Disable SMBv1 client-side via registry
$smbClientPath = "HKLM:\SYSTEM\CurrentControlSet\Services\mrxsmb10"
Set-ItemProperty -Path $smbClientPath -Name "Start" -Value 4 -Type DWord

# Remove SMBv1 dependencies from LanmanWorkstation
$depPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation"
$currentDeps = (Get-ItemProperty $depPath).DependOnService | Where-Object { $_ -ne "mrxsmb10" }
Set-ItemProperty -Path $depPath -Name "DependOnService" -Value $currentDeps -Type MultiString

# Audit SMB configuration across all servers
$servers = Get-ADComputer -Filter { OperatingSystem -like "*Server*" } |
    Select-Object -ExpandProperty Name

$results = Invoke-Command -ComputerName $servers -ScriptBlock {
    $serverPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
    $server = Get-ItemProperty $serverPath -ErrorAction SilentlyContinue

    $smbv1 = (Get-SmbServerConfiguration).EnableSMB1Protocol

    [PSCustomObject]@{
        Server              = $env:COMPUTERNAME
        SMBv1Enabled        = $smbv1
        AutoShareServer     = $server.AutoShareServer
        RequireSigning      = $server.RequireSecuritySignature
        EncryptData         = (Get-SmbServerConfiguration).EncryptData
    }
} -ErrorAction SilentlyContinue

$results | Export-Csv "C:\Admin\smb-audit.csv" -NoTypeInformation
$results | Format-Table -AutoSize

# Enable SMBv1 auditing to detect legacy clients
Invoke-Command -ComputerName $servers -ScriptBlock {
    # Enable SMB1 audit logging
    Set-SmbServerConfiguration -AuditSmb1Access $true -Force
    Write-Output "$env:COMPUTERNAME : SMB1 auditing enabled"
}

# After a few days, collect SMBv1 connection events (Event ID 3000)
Invoke-Command -ComputerName $servers -ScriptBlock {
    $events = Get-WinEvent -FilterHashtable @{
        LogName = 'Microsoft-Windows-SMBServer/Audit'
        Id = 3000
    } -MaxEvents 50 -ErrorAction SilentlyContinue

    foreach ($event in $events) {
        [PSCustomObject]@{
            Server    = $env:COMPUTERNAME
            Time      = $event.TimeCreated
            Client    = $event.Properties[0].Value
        }
    }
} | Sort-Object Client -Unique | Format-Table -AutoSize

# Apply SMB hardening to all servers
$servers = Get-Content "C:\Admin\server-list.txt"

Invoke-Command -ComputerName $servers -ScriptBlock {
    $serverPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
    $clientPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters"

    # 1. Disable SMBv1
    Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force
    Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\mrxsmb10" -Name "Start" -Value 4 -Type DWord

    # 2. Require SMB signing (server and client)
    Set-ItemProperty -Path $serverPath -Name "RequireSecuritySignature" -Value 1 -Type DWord
    Set-ItemProperty -Path $serverPath -Name "EnableSecuritySignature" -Value 1 -Type DWord
    Set-ItemProperty -Path $clientPath -Name "RequireSecuritySignature" -Value 1 -Type DWord
    Set-ItemProperty -Path $clientPath -Name "EnableSecuritySignature" -Value 1 -Type DWord

    # 3. Disable administrative shares (except on domain controllers)
    $isDC = (Get-WmiObject Win32_ComputerSystem).DomainRole -ge 4
    if (-not $isDC) {
        Set-ItemProperty -Path $serverPath -Name "AutoShareServer" -Value 0 -Type DWord
    }

    # 4. Restrict null sessions
    Set-ItemProperty -Path $serverPath -Name "RestrictNullSessAccess" -Value 1 -Type DWord
    Set-ItemProperty -Path $serverPath -Name "NullSessionPipes" -Value @() -Type MultiString
    Set-ItemProperty -Path $serverPath -Name "NullSessionShares" -Value @() -Type MultiString

    # 5. Disable insecure guest authentication
    Set-ItemProperty -Path $clientPath -Name "AllowInsecureGuestAuth" -Value 0 -Type DWord
    Set-ItemProperty -Path $clientPath -Name "EnablePlainTextPassword" -Value 0 -Type DWord

    # 6. Enable SMB encryption on file servers
    $isFileServer = (Get-WindowsFeature FS-FileServer -ErrorAction SilentlyContinue).Installed
    if ($isFileServer) {
        Set-SmbServerConfiguration -EncryptData $true -Force
    }

    Write-Output "$env:COMPUTERNAME : SMB hardening applied (DC=$isDC, FileServer=$isFileServer)"
}

# Deploy firewall rule to block SMB between workstations (via GPO or direct)
$workstations = Get-ADComputer -Filter { OperatingSystem -like "*Windows 10*" -or OperatingSystem -like "*Windows 11*" } |
    Select-Object -ExpandProperty Name

Invoke-Command -ComputerName $workstations -ScriptBlock {
    # Block inbound SMB from other workstations (allow from servers only)
    New-NetFirewallRule -DisplayName "Block SMB Lateral Movement" `
        -Direction Inbound `
        -Protocol TCP `
        -LocalPort 445 `
        -RemoteAddress "10.0.0.0/24" `
        -Action Block `
        -Profile Domain

    Write-Output "$env:COMPUTERNAME : SMB lateral movement blocked"
} -ErrorAction SilentlyContinue

# Validate SMB hardening across all servers
$servers = Get-Content "C:\Admin\server-list.txt"

Invoke-Command -ComputerName $servers -ScriptBlock {
    $cfg = Get-SmbServerConfiguration
    $serverPath = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
    $server = Get-ItemProperty $serverPath

    [PSCustomObject]@{
        Server           = $env:COMPUTERNAME
        SMBv1            = $cfg.EnableSMB1Protocol
        RequireSigning   = [bool]$server.RequireSecuritySignature
        EncryptData      = $cfg.EncryptData
        AdminShares      = [bool]$server.AutoShareServer
        NullSessions     = -not [bool]$server.RestrictNullSessAccess
    }
} | Format-Table -AutoSize