In the Event Viewer on Windows 10: Type Event Viewer in the Start Menu.
The path in Event Viewer is:
Applications and Services Logs/Microsoft/Windows/SMBServer.
If you are not running an SMB Server, you will notice that the files of SMBServer are Audit, Connectivity, Operational, and Security.
Interestingly, SMBServer is still running despite not hosting an actual file sharing program. However, you can see that the connectivity file is empty.
Under the Operational file:
"You should expect this event when the server starts listening on an interface, such as during system restart or when enabling a network adaptor. No user action is required."
By default the SMBServer is ready to go. This may be a security vulnerability if you have open ports on your router for hosting websites or if your router is old and has vulnerabilities.
Here is how you disable SMBServer.
Check if SMB Server has any shares (which is by default on windows).
Use Powershell admin privilleges and type the commands below (ignoring everything after the #)
Get-SmbShare #to see the shares
Get-Service LanmanServer -DependentServices #shows you if there are any services using SMBServer
Set-Service LanmanServer -StartupType Disabled -PassThru | Stop-Service -Force #disable SMBService
You can also disable your computer ability to connect to remote devices.
Get-Service LanmanWorkstation -DependentServices #check if using any shares on other devices
Set-Service LanmanWorkstation -StartupType Disabled -PassThru | Stop-Service -Force #disable ability to connect to SMB shares
Thanks for Reading
