{"id":208610,"date":"2024-01-18T12:03:25","date_gmt":"2024-01-18T12:03:25","guid":{"rendered":"https:\/\/www.ninjaone.com\/script-hub\/como-desactivar-smbv1-powershell\/"},"modified":"2024-03-04T17:56:54","modified_gmt":"2024-03-04T17:56:54","slug":"como-desactivar-smbv1-powershell","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/es\/script-hub\/como-desactivar-smbv1-powershell\/","title":{"rendered":"C\u00f3mo desactivar SMBv1 (protocolo Bloque de mensajes del servidor versi\u00f3n 1) con PowerShell"},"content":{"rendered":"

El protocolo Bloque de mensajes del servidor (SMB)<\/a> existe desde hace bastante tiempo y es una especie de columna vertebral para compartir archivos y otras operaciones de red. Sin embargo, la primera versi\u00f3n, SMBv1, actualmente se considera un problema debido a una multitud de vulnerabilidades de seguridad. Si eres un profesional de TI o un proveedor de servicios gestionados (MSP), garantizar la seguridad de la red deber\u00eda ser tu principal preocupaci\u00f3n. Entonces, \u00bfc\u00f3mo desactivar SMBv1<\/strong> de forma eficaz?<\/p>\n

\u00bfQu\u00e9 hace el script?<\/h2>\n

Este script PowerShell ha sido dise\u00f1ado con un prop\u00f3sito muy concreto: desactivar SMBv1 en entornos Windows. Funciona utilizando una secuencia de cmdlets de PowerShell incorporados y modificaciones del Registro para garantizar que SMBv1 est\u00e1 completamente desactivado. El script puede ejecutarse en un entorno Windows 10 o Windows Server 2016 o posterior, lo que lo hace muy vers\u00e1til y valioso para cualquier sistema Windows moderno.<\/p>\n

El script: desactivar SMBv1<\/h2>\n
#Requires -Version 5.1\r\n\r\n<#\r\n.SYNOPSIS\r\n    Disables SMB v1\r\n.DESCRIPTION\r\n    Disables SMB v1 via Get-WindowsOptionalFeature, Set-SmbServerConfiguration, or Registry\r\n.EXAMPLE\r\n    No parameters needed.\r\n.EXAMPLE\r\n    PS C:> Disable-SMBv1.ps1\r\n    No parameters needed.\r\n.OUTPUTS\r\n    None\r\n.NOTES\r\n    Minimum OS Architecture Supported: Windows 10, Windows Server 2016\r\n    Release Notes:\r\n    Initial Release\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam ()\r\n\r\nbegin {\r\n    function Test-IsElevated {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n        if ($p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator))\r\n        { Write-Output $true }\r\n        else\r\n        { Write-Output $false }\r\n    }\r\n    function Set-ItemProp {\r\n        param (\r\n            $Path,\r\n            $Name,\r\n            $Value,\r\n            [ValidateSet(\"DWord\", \"QWord\", \"String\", \"ExpandedString\", \"Binary\", \"MultiString\", \"Unknown\")]\r\n            $PropertyType = \"DWord\"\r\n        )\r\n        # Do not output errors and continue\r\n        $ErrorActionPreference = [System.Management.Automation.ActionPreference]::SilentlyContinue\r\n        if (-not $(Test-Path -Path $Path)) {\r\n            # Check if path does not exist and create the path\r\n            New-Item -Path $Path -Force | Out-Null\r\n        }\r\n        if ((Get-ItemProperty -Path $Path -Name $Name)) {\r\n            # Update property and print out what it was changed from and changed to\r\n            $CurrentValue = Get-ItemProperty -Path $Path -Name $Name\r\n            try {\r\n                Set-ItemProperty -Path $Path -Name $Name -Value $Value -Force -Confirm:$false -ErrorAction Continue | Out-Null\r\n            }\r\n            catch {\r\n                Write-Error $_\r\n            }\r\n            Write-Host \"$Path$Name changed from $CurrentValue to $(Get-ItemProperty -Path $Path -Name $Name)\"\r\n        }\r\n        else {\r\n            # Create property with value\r\n            try {\r\n                New-ItemProperty -Path $Path -Name $Name -Value $Value -PropertyType $PropertyType -Force -Confirm:$false -ErrorAction Continue | Out-Null\r\n            }\r\n            catch {\r\n                Write-Error $_\r\n            }\r\n            Write-Host \"Set $Path$Name to $(Get-ItemProperty -Path $Path -Name $Name)\"\r\n        }\r\n        $ErrorActionPreference = [System.Management.Automation.ActionPreference]::Continue\r\n    }\r\n    $Disable = 0\r\n    # $Enable = 1 # Not Used\r\n}\r\nprocess {\r\n    if (-not (Test-IsElevated)) {\r\n        Write-Error -Message \"Access Denied. Please run with Administrator privileges.\"\r\n        exit 1\r\n    }\r\n    \r\n    # Try using Get-WindowsOptionalFeature first\r\n    if (-not $(Get-Command -Name \"Get-WindowsOptionalFeature\").Name -like \"Get-WindowsOptionalFeature\") {\r\n        Write-Host \"Get-WindowsOptionalFeature command not found. Continuing.\"\r\n    }\r\n    else {\r\n        if ((Get-WindowsOptionalFeature -Online -FeatureName smb1protocol -ErrorAction SilentlyContinue).State -notlike \"Disabled\") {\r\n            # Disables smb1protocol feature\r\n            try {\r\n                Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol\r\n                # Disabled SMB1, exit\r\n                exit 0\r\n            }\r\n            catch {\r\n                Write-Host \"smb1protocol feature not found. Continuing.\"\r\n            }\r\n        }\r\n    }\r\n\r\n    if (-not $(Get-Command -Name \"Get-SmbServerConfiguration\").Name -like \"Get-SmbServerConfiguration\") {\r\n        Write-Host \"Get-SmbServerConfiguration command not found. Continuing.\"\r\n        $Path = \"HKLM:SYSTEMCurrentControlSetServicesLanmanServerParameters\"\r\n        $Name = \"SMB1\"\r\n        # https:\/\/docs.microsoft.com\/en-us\/windows-server\/storage\/file-server\/troubleshoot\/detect-enable-and-disable-smbv1-v2-v3#registry-editor\r\n        # Sets SMB1 to 0\r\n        Set-ItemProp -Path $Path -Name $Name -Value $Disable\r\n    }\r\n    if ((Get-SmbServerConfiguration).EnableSMB1Protocol) {\r\n        try {\r\n            Set-SmbServerConfiguration -EnableSMB1Protocol $false            \r\n        }\r\n        catch {\r\n            Write-Host \"Failed to disable SMBv1.\"\r\n            exit 1\r\n        }\r\n    }\r\n}\r\nend {}<\/pre>\n
 <\/p>\n\n
Accede a m\u00e1s de 300 scripts en el Dojo de NinjaOne<\/p>\n
Obt\u00e9n acceso<\/a><\/p>\n<\/div>\n
Preocupaciones de seguridad relacionadas con SMBv1<\/h2>\n
SMBv1 es conocido por sus carencias en t\u00e9rminos de seguridad. Ha sido blanco frecuente de diversos tipos de ataques, ransomware y violaciones de datos. Tener SMBv1 activado es como dejar la puerta de casa abierta; simplemente est\u00e1s invitando a los problemas a entrar. Este script de PowerShell resuelve eficazmente el problema desactivando SMBv1.<\/p>\n
Tiempo y eficacia<\/h2>\n
Desactivar manualmente SMBv1 puede necesitar mucho tiempo, especialmente en entornos de red a gran escala. Este script automatiza el proceso, ahorrando tiempo y esfuerzo. Para los MSP que gestionan redes de varios clientes, esta herramienta es una bendici\u00f3n.<\/p>\n
Un enfoque integral<\/h2>\n
El script intenta desactivar SMBv1 a trav\u00e9s de m\u00faltiples v\u00edas, incluyendo el cmdlet Get-WindowsOptionalFeature, el cmdlet Set-SmbServerConfiguration y ediciones directas del Registro. Esto garantiza que el protocolo se desactive, incluso si uno de los m\u00e9todos falla o no est\u00e1 disponible en el sistema en cuesti\u00f3n.<\/p>\n
C\u00f3mo utilizar el script para desactivar SMBv1<\/h2>\n
Ejecutar el script es sencillo. He aqu\u00ed una gu\u00eda r\u00e1pida:<\/p>\n
    \n
  1. Guarda el script en un archivo llamado Disable-SMBv1.ps1.<\/li>\n
  2. Abre PowerShell como administrador.<\/li>\n
  3. Navega hasta la carpeta donde guardaste el script.<\/li>\n
  4. Ejecuta el script escribiendo PS C:>.Disable-SMBv1.ps1 y pulsando Intro.<\/li>\n<\/ol>\n
    Aseg\u00farate de que tienes privilegios de Administrador, o el script terminar\u00e1, precisamente para que no realices cambios que no deber\u00edas accidentalmente.<\/p>\n
    \u00bfA qui\u00e9n le resulta \u00fatil este script?<\/h2>\n