DisableSMBCompression

CVE-2020-0796 Flaw Mitigation - Active Directory Administrative Templates

The little we know about the new SMB3 flaw, is that we've been provided this mitigation for SMB3 servers:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force

This repository contains ADMX templates to provide a nice interface to this setting. This allows easy mass deployment of the given mitigation, and easy rollback when desired.

Installation

See this Microsoft guide for installing new admx files: https://support.microsoft.com/en-au/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administra

Under "Administrative Templates", find the new "SMB Compression Support" setting as below.

Applicability

I recommend careful consideration before deploying outside of Windows 10 machines. Windows 2016 Server is not vulnerable, and only the SAC builds of Windows 2019 (which are Server Core only) are considered vulnerable. There has been little (no) QA done on the impact of this setting on server roles such as S2D. As always, please test a small group before a larger deployment.

The majority of environments don't appear to be running SMB compression in practice, but please consider whether this is suitable to you.

Limitations

Nothing described as a "mitigation" should be considered a complete fix. Please roll patches as soon as they are out. This change disables compression on the local SMB server, where Microsoft's guide appears to suggest this can still be exploited to attack the client. See Microsoft's guidance for further information.

References:

https://www.bleepingcomputer.com/news/security/microsoft-leaks-info-on-wormable-windows-smbv3-cve-2020-0796-flaw/ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200005