Posted in : Citrix, Virtual Apps and Desktops, Windows Server By Stina Perbo Translate with Google ⟶

6 years ago

When installing Provision Services 7.x and below on a Windows 2008 R2 or Windows 2012 R2 – The Provisioning installer will disable SMB2 and only allow SMB1 on the server.
NOTE: SMB2 will still be enabled with a new install of PVS 7.13 (Thanks Andrew Wood).
Verify which SMB protocols are enabled on Windows 2012 R2 by running the following powershell command:

Get-SmbServerConfiguration | Select EnableSMB1Protocol,EnableSMB2Protocol

View SMB Protocols

View SMB Protocols



SMB 1.0 (or SMB1) – Used in Windows 2000, Windows XP and Windows Server 2003 R2 is no longer supported and you should use SMB2 or SMB3 which has many improvements from its predecessor. Another big reason is to prevent the security-hole that the WannaCry/Wcry/WannaCrypt0r-ransomware utilizes to infect and spread if you have not installed the security patch MS from Microsoft released 14th of March 2017.
Here’s a very brief summary of what changed with each version of SMB:

  • From SMB 1.0 to SMB 2.0 – The first major redesign of SMB – Windows Vista (SP1 or later) and Windows Server 2008
    • Increased file sharing scalability
    • Improved performance
      • Request compounding
      • Asynchronous operations
      • Larger reads/writes
    • More secure and robust
      • Small command set
      • Signing now uses HMAC SHA-256 instead of MD5
      • SMB2 durability
  • From SMB 2.0 to SMB 2.1 – The version used in Windows 7 and Windows Server 2008 R2
    • File leasing improvements
    • Large MTU support
    • BranchCache
  • SMB 3.0 – The version used in Windows 8 and Windows Server 2012

SMB2 has a requirement to utilize Oplocks. Enabling Oplocks will not cause any failures so long as the write cache is not stored on the Provisioning Server.
SMB2.1 introduced leasing and is more flexible and results in significant performance improvement in a high latency network.
If the write cache is on the PVS server then this would happen:

  1. You have two PVS servers, PVS1 and PVS2.
  2. The write cache for targets is hosted on \\FileSRV01\store
  3. A target device is connected to PVS1 and PVS1 becomes unavailable.
  4. The target device fails over and connects to PVS2.
  5. PVS2 cannot connect to the write cache file because PVS1 still has the exclusive OPlock to the file. Eventually, the OPlock will timeout and PVS2 will be able to connect to the write cache file, but there will be a delay.
    Cache-on-Server

ENABLE SMB2 and DISABLE SMB1

To activate SMB2 and disable SMB1 on Windows 2008 run the following PowerShell command:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB1 -Type DWORD -Value 0 -Force
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB2 -Type DWORD -Value 1 -Force

To activate SMB2 and disable SMB1 on Windows 2012 run the following PowerShell command:

Set-SmbServerConfiguration -EnableSMB2Protocol $true
Set-SmbServerConfiguration -EnableSMB1Protocol $false
Get-SmbServerConfiguration | Select EnableSMB1Protocol,EnableSMB2Protocol

A reboot is required to activate the new settings. As always, perform any changes in a test scenario first, before deploying into production. This is important since Windows XP and Windows 2003 utilizes SMB1 and will not be able to communicate with servers over SMB where SMB1 has been disabled.
If you have any questions or feedback about above, feel free to leave a comment below!

Tags : Citrix, Provisioning

Personlig rådgivning

Vi erbjuder personlig rådgivning med författaren för 1400 SEK per timme. Anmäl ditt intresse i här så återkommer vi så snart vi kan.

Comments

Andrew Wood says

This is useful info - all be it with a note that SMB2 is enabled with a new install of 7.13

says

Thanks for the input Andrew! I have updated the post with your comment.

Marc says

SMB1 on pVS is a fail in any way. It would be very slow, as large system caching would not be possible.
So any ctx admin would have enabled SMB2 on 2008r2 or higher anyway.

says

Agreed, SMBv2 should be activated on 2008R2 or higher. The issue is that the earlier versions of provisioning installer would disable SMBv2/3 on the server where Provisioning Services was being installed on. Not everyone was aware of this happening. If you have installed or upgraded a Provisioning Server from earlier versions you should go back and verify that SMBv2/3 is not disabled.

Add comment

Your comment will be revised by the site if needed.