{"id":208381,"date":"2024-01-03T11:31:11","date_gmt":"2024-01-03T11:31:11","guid":{"rendered":"https:\/\/www.ninjaone.com\/script-hub\/comment-desactiver-smbv1-powershell\/"},"modified":"2024-03-04T20:35:50","modified_gmt":"2024-03-04T20:35:50","slug":"comment-desactiver-smbv1-powershell","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/fr\/script-hub\/comment-desactiver-smbv1-powershell\/","title":{"rendered":"Comment d\u00e9sactiver SMBv1 (Server Message Block Protocol) avec PowerShell"},"content":{"rendered":"

Le protocole Server Message Block Protocol (SMB)<\/a> existe depuis un certain temps et sert de pilier au partage de fichiers et \u00e0 diverses autres op\u00e9rations de r\u00e9seau. Cependant, la version la plus ancienne, SMBv1, est aujourd’hui consid\u00e9r\u00e9e comme un handicap en raison d’une multitude de failles de s\u00e9curit\u00e9. Si vous \u00eates un professionnel de l’informatique ou un fournisseur de services g\u00e9r\u00e9s (MSP), la s\u00e9curit\u00e9 de votre r\u00e9seau doit \u00eatre votre principale pr\u00e9occupation. Comment d\u00e9sactiver efficacement SMBv1 ?<\/strong><\/p>\n

Que fait le script ?<\/h2>\n

Le script PowerShell pr\u00e9sent\u00e9 ici a \u00e9t\u00e9 con\u00e7u dans un but tr\u00e8s pr\u00e9cis : d\u00e9sactiver SMBv1 dans les environnements Windows. Il utilise une s\u00e9quence de cmdlets PowerShell int\u00e9gr\u00e9s et de manipulations du registre pour s’assurer que SMBv1 est compl\u00e8tement d\u00e9sactiv\u00e9. Le script peut \u00eatre ex\u00e9cut\u00e9 dans un environnement Windows 10 ou Windows Server 2016 ou plus r\u00e9cent, ce qui le rend tr\u00e8s polyvalent et pr\u00e9cieux pour tout syst\u00e8me Windows moderne.<\/p>\n

Le script : D\u00e9sactiver SMBv1<\/h2>\n
#Requires -Version 5.1\r\n\r\n<#\r\n.SYNOPSIS\r\n    Disables SMB v1\r\n.DESCRIPTION\r\n    Disables SMB v1 via Get-WindowsOptionalFeature, Set-SmbServerConfiguration, or Registry\r\n.EXAMPLE\r\n    No parameters needed.\r\n.EXAMPLE\r\n    PS C:> Disable-SMBv1.ps1\r\n    No parameters needed.\r\n.OUTPUTS\r\n    None\r\n.NOTES\r\n    Minimum OS Architecture Supported: Windows 10, Windows Server 2016\r\n    Release Notes:\r\n    Initial Release\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam ()\r\n\r\nbegin {\r\n    function Test-IsElevated {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n        if ($p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator))\r\n        { Write-Output $true }\r\n        else\r\n        { Write-Output $false }\r\n    }\r\n    function Set-ItemProp {\r\n        param (\r\n            $Path,\r\n            $Name,\r\n            $Value,\r\n            [ValidateSet(\"DWord\", \"QWord\", \"String\", \"ExpandedString\", \"Binary\", \"MultiString\", \"Unknown\")]\r\n            $PropertyType = \"DWord\"\r\n        )\r\n        # Do not output errors and continue\r\n        $ErrorActionPreference = [System.Management.Automation.ActionPreference]::SilentlyContinue\r\n        if (-not $(Test-Path -Path $Path)) {\r\n            # Check if path does not exist and create the path\r\n            New-Item -Path $Path -Force | Out-Null\r\n        }\r\n        if ((Get-ItemProperty -Path $Path -Name $Name)) {\r\n            # Update property and print out what it was changed from and changed to\r\n            $CurrentValue = Get-ItemProperty -Path $Path -Name $Name\r\n            try {\r\n                Set-ItemProperty -Path $Path -Name $Name -Value $Value -Force -Confirm:$false -ErrorAction Continue | Out-Null\r\n            }\r\n            catch {\r\n                Write-Error $_\r\n            }\r\n            Write-Host \"$Path$Name changed from $CurrentValue to $(Get-ItemProperty -Path $Path -Name $Name)\"\r\n        }\r\n        else {\r\n            # Create property with value\r\n            try {\r\n                New-ItemProperty -Path $Path -Name $Name -Value $Value -PropertyType $PropertyType -Force -Confirm:$false -ErrorAction Continue | Out-Null\r\n            }\r\n            catch {\r\n                Write-Error $_\r\n            }\r\n            Write-Host \"Set $Path$Name to $(Get-ItemProperty -Path $Path -Name $Name)\"\r\n        }\r\n        $ErrorActionPreference = [System.Management.Automation.ActionPreference]::Continue\r\n    }\r\n    $Disable = 0\r\n    # $Enable = 1 # Not Used\r\n}\r\nprocess {\r\n    if (-not (Test-IsElevated)) {\r\n        Write-Error -Message \"Access Denied. Please run with Administrator privileges.\"\r\n        exit 1\r\n    }\r\n    \r\n    # Try using Get-WindowsOptionalFeature first\r\n    if (-not $(Get-Command -Name \"Get-WindowsOptionalFeature\").Name -like \"Get-WindowsOptionalFeature\") {\r\n        Write-Host \"Get-WindowsOptionalFeature command not found. Continuing.\"\r\n    }\r\n    else {\r\n        if ((Get-WindowsOptionalFeature -Online -FeatureName smb1protocol -ErrorAction SilentlyContinue).State -notlike \"Disabled\") {\r\n            # Disables smb1protocol feature\r\n            try {\r\n                Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol\r\n                # Disabled SMB1, exit\r\n                exit 0\r\n            }\r\n            catch {\r\n                Write-Host \"smb1protocol feature not found. Continuing.\"\r\n            }\r\n        }\r\n    }\r\n\r\n    if (-not $(Get-Command -Name \"Get-SmbServerConfiguration\").Name -like \"Get-SmbServerConfiguration\") {\r\n        Write-Host \"Get-SmbServerConfiguration command not found. Continuing.\"\r\n        $Path = \"HKLM:SYSTEMCurrentControlSetServicesLanmanServerParameters\"\r\n        $Name = \"SMB1\"\r\n        # https:\/\/docs.microsoft.com\/en-us\/windows-server\/storage\/file-server\/troubleshoot\/detect-enable-and-disable-smbv1-v2-v3#registry-editor\r\n        # Sets SMB1 to 0\r\n        Set-ItemProp -Path $Path -Name $Name -Value $Disable\r\n    }\r\n    if ((Get-SmbServerConfiguration).EnableSMB1Protocol) {\r\n        try {\r\n            Set-SmbServerConfiguration -EnableSMB1Protocol $false            \r\n        }\r\n        catch {\r\n            Write-Host \"Failed to disable SMBv1.\"\r\n            exit 1\r\n        }\r\n    }\r\n}\r\nend {}<\/pre>\n
 <\/p>\n\n
Acc\u00e9dez \u00e0 plus de 700 scripts dans le Dojo NinjaOne<\/p>\n
Obtenez l’acc\u00e8s<\/a><\/p>\n<\/div>\n
Pr\u00e9occupations en mati\u00e8re de s\u00e9curit\u00e9 concernant SMBv1<\/h2>\n
SMBv1 est r\u00e9put\u00e9 pour ses lacunes en mati\u00e8re de s\u00e9curit\u00e9. Il a souvent \u00e9t\u00e9 la cible de divers types d’attaques, de ransomwares et de vols de donn\u00e9es. Laisser SMBv1 activ\u00e9, c’est comme laisser sa porte d’entr\u00e9e ouverte; c’est chercher \u00e0 s’attirer des ennuis. Ce script PowerShell r\u00e9sout efficacement ce probl\u00e8me en d\u00e9sactivant SMBv1.<\/p>\n
Temps et efficacit\u00e9<\/h2>\n
La d\u00e9sactivation manuelle de SMBv1 peut prendre beaucoup de temps, en particulier dans les grands r\u00e9seaux. Ce script automatise le processus, ce qui permet d’\u00e9conomiser du temps et des ressources. Pour les entreprises MSP qui g\u00e8rent les r\u00e9seaux de plusieurs clients, cet outil est indispensable.<\/p>\n
Approche globale<\/h2>\n
Le script tente de d\u00e9sactiver SMBv1 par plusieurs moyens, notamment la cmdlet Get-WindowsOptionalFeature, la cmdlet Set-SmbServerConfiguration et des modifications directes du registre. Cela garantit que le protocole est d\u00e9sactiv\u00e9, m\u00eame si l’une des m\u00e9thodes \u00e9choue ou n’est pas disponible sur le syst\u00e8me en question.<\/p>\n
Comment utiliser le script de d\u00e9sactivation de SMBv1 ?<\/h2>\n
L’ex\u00e9cution du script est simple. Voici un guide rapide :<\/p>\n
    \n
  1. Enregistrez le script dans un fichier nomm\u00e9 Disable-SMBv1.ps1.<\/li>\n
  2. Ouvrez PowerShell en tant qu’administrateur.<\/li>\n
  3. Naviguez jusqu’au dossier dans lequel vous avez enregistr\u00e9 le script.<\/li>\n
  4. Ex\u00e9cutez le script en tapant PS C :>.Disable-SMBv1.ps1 et en appuyant sur Entr\u00e9e.<\/li>\n<\/ol>\n
    Assurez-vous d’avoir les privil\u00e8ges d’administrateur, sinon le script se terminera, ce qui vous \u00e9vitera d’effectuer accidentellement des modifications que vous n’auriez pas d\u00fb.<\/p>\n
    Qui a besoin de ce script ?<\/h2>\n