Hardening recommendations (1/4)

• If server-side SMB support is not needed, disable SMB

  • Only possible for isolated (not part of a Windows domain) systems
  • If needed, remote administration still possible using Terminal Services or SSH

• To disable SMB support

  • Disable NetBIOS over TCP/IP support
  • Stop the server (lanmanserver) service

• More details on Windows network services hardening

  • http://www.hsc.fr/tips/min_srv_res_win.en.html
  • http://www.hsc.fr/tips/min_w2k3_net_srv.html