Scenario

• Product: ZCF
• Component: ZStack Cloud
• Version: 5.4.x
• Operating-system environment: H84r management environment and Windows guest operating system
• Deployment: Dual management nodes
• Trigger: Port 445 exposure requires security hardening.

Symptoms

• The environment must reduce port-445 risk.
• Do not block the port directly at the platform side; disable the Windows SMB feature instead.

Assessment

1. Confirm that the target risk originates from the Windows SMB service.
2. After disabling SMB 1.0.x/CIFS, verify that related sharing capabilities are restricted as expected.

Cause

The objective is to disable Windows SMB capabilities and reduce port-445 risk. This is Windows-feature removal, not Linux-side network-policy configuration.

Resolution

1. Preparation

• Risk level: Low.
• Preserve normal VM workload operation.
• Change only the relevant system parameter or feature.

2. Disable Windows SMB service
3. Open:

      Control Panel -> Programs -> Turn Windows features on or off

• Expected result: The Windows Features management page opens.

2. Locate:

      SMB 1.0/CIFS File Sharing Support

3. Clear the checkbox.

• Expected result: SMB 1.0.x/CIFS File Sharing Support is disabled.

4. Apply the change or restart as required by Windows.

• Expected result: Related SMB capabilities are no longer enabled.

Verification

• Verify that SMB 1.0.x/CIFS File Sharing Support is unchecked in Windows Features.
• Verify that legacy SMB sharing capability associated with port 445 is no longer exposed or available.

Risks and rollback

• Risk: Disabling the feature can affect applications that still depend on legacy SMB sharing.
• Risk level: Low.
• Rollback: Log in to Windows and re-enable the relevant feature.