SMBv1 Status Audit/Autofix
Purpose
This solution detects the current SMBv1 configuration and recent SMBv1 usage on supported Windows machines and provides an automated remediation option to disable SMBv1 when required.
The solution supports the following platforms:
- Windows Workstations
- Windows Servers
Administrators can centrally select the SMBv1 vulnerability action using a NinjaOne custom field. The Automation - SMBv1 Status Audit/Autofix then evaluates the endpoint's SMBv1 configuration, reports its current state, and disables SMBv1 when remediation is selected.
Associated Content
Custom Fields
| Content | Purpose |
|---|---|
| cPVAL SMB1 Vulnerability Action | Custom Field to choose the SMB1 Vulnerability action to perform on the machine. Detection reports the current SMBv1 state without making any changes. Detection and Remediation disables SMBv1 and then reports the resulting state. |
| cPVAL SMB1 Server Status | Indicates whether SMBv1 Server is enabled on the machine. This field is populated by the Automation - SMBv1 Status Audit/Autofix. |
| cPVAL SMB1 Client Status | Indicates whether SMBv1 client is enabled on the machine. This field is populated by the Automation - SMBv1 Status Audit/Autofix. |
| cPVAL SMB1 In Use | Indicates whether SMBv1 traffic has been detected on the machine. This field is populated by the Automation - SMBv1 Status Audit/Autofix. |
| cPVAL SMB1 Autofix Status | Stores the SMBv1 status after the Automation - SMBv1 Status Audit/Autofix executes. Indicates whether SMBv1 is enabled and whether remediation is required. |
| cPVAL SMB1 Autofix Vulnerability State | Indicates whether the device is considered vulnerable after the Automation - SMBv1 Status Audit/Autofix executes. |
| cPVAL SMB1 Autofix Logging | Stores the remediation result reported by the Automation - SMBv1 Status Audit/Autofix. |
| cPVAL SMB1 Logging Time | Indicates the date and time when the Automation - SMBv1 Status Audit/Autofix was last executed. |
Automation
| Name | Purpose |
|---|---|
| SMBv1 Status Audit/Autofix | Checks for SMBv1 vulnerabilities, detects its current state and recent usage, disables SMBv1 when remediation is selected, and verifies the resulting configuration. |
Group
| Name | Purpose |
|---|---|
| cPVAL SMBv1 Status Audit | This group displays the SMB1 status of machines where a vulnerability action is selected using the Custom Field - cPVAL SMB1 Vulnerability Action. The status is populated by the Automation - SMBv1 Status Audit/Autofix. |
Task
| Name | Purpose |
|---|---|
| SMB1 Detection/Remediation | Executes the Automation - SMBv1 Status Audit/Autofix daily on Windows machines where vulnerability Action is selected through Custom Field - cPVAL SMB1 Vulnerability Action. |
Implementation
Step 1: Create the Following Custom Fields
Create all the custom fields listed below in NinjaOne. These fields are required for the solution to function correctly.
- cPVAL SMB1 Vulnerability Action
- cPVAL SMB1 Server Status
- cPVAL SMB1 Client Status
- cPVAL SMB1 In Use
- cPVAL SMB1 Autofix Status
- cPVAL SMB1 Autofix Vulnerability State
- cPVAL SMB1 Autofix Logging
- cPVAL SMB1 Logging Time
Step 2: Configure the SMBv1 Vulnerability Action
Set the cPVAL SMB1 Vulnerability Action custom field to the action that should be performed on the endpoint.
The available actions determine whether the automation only detects the SMBv1 configuration or also performs remediation.
- Detection - Detects and reports the current SMBv1 configuration without making changes.
- Detection and Remediation - Detects the SMBv1 configuration, disables SMBv1, and then verifies and reports the resulting configuration.
Endpoints where the field is not configured are not targeted by the SMBv1 task.
Step 3: Create the Automation
Set up the Automation - SMBv1 Status Audit/Autofix automation.
Step 4: Create the Group
Create the Group - cPVAL SMBv1 Status Audit group.
The group uses the SMBv1 status information populated by the automation to identify machines where SMBv1 status has been evaluated.
The group should target Windows machines where the cPVAL SMB1 Vulnerability Action custom field has been configured.
Step 5: Create the Task
Create the Task - SMB1 Detection/Remediation task.
Configure the task to execute the Automation - SMBv1 Status Audit/Autofix daily.
The task should target Windows machines where the cPVAL SMB1 Vulnerability Action custom field has been configured with a supported action.
FAQ
Q: Which platforms are supported?
The solution supports Windows Workstations and Windows Servers.
Q: What does the Detection action do?
The Detection action checks the current SMBv1 Server and SMBv1 Client configuration and reports the detected state without making changes to the endpoint.
Q: What does the Detection and Remediation action do?
The Detection and Remediation action checks the current SMBv1 configuration, disables SMBv1 when enabled, and then verifies the resulting configuration.
Q: Does the solution check whether SMBv1 is being used?
Yes. The automation checks for SMBv1 traffic usage and records the result in the cPVAL SMB1 In Use custom field.
Q: How does the solution determine whether a device is vulnerable?
The solution evaluates the SMBv1 configuration after the automation executes and records the resulting vulnerability state in the cPVAL SMB1 Autofix Vulnerability State custom field.
Q: What happens if remediation is required?
When Detection and Remediation is selected, the automation disables SMBv1 and then verifies the resulting SMBv1 configuration.
Q: Where can I see the remediation result?
The remediation result is stored in the cPVAL SMB1 Autofix Logging custom field.
Q: Where can I see when the automation last ran?
The last execution date and time are stored in the cPVAL SMB1 Logging Time custom field.
Q: What happens when the SMBv1 Vulnerability Action field is not configured?
When the cPVAL SMB1 Vulnerability Action custom field is not configured with a supported action, the endpoint is not targeted by the SMBv1 detection and remediation task.
Q: Can the solution remediate both SMBv1 Client and SMBv1 Server?
Yes. The remediation process evaluates and disables the applicable SMBv1 Client and SMBv1 Server components on supported Windows endpoints.
Q: Is any manual configuration required on the endpoint?
No. The solution uses the configured NinjaOne custom fields, automation, group, and scheduled task to detect and remediate SMBv1.
Changelog
2026-10-12
- Initial version of the document.