AD-DC-03: SMBv3.1.1 enabled count should be retrievable
| ID | AD-DC-03 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Domain controllers |
| Security area | Infrastructure hardening |
| Resource type | DomainController |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”SMBv3.1.1 is the latest version of the Server Message Block protocol and includes important security enhancements:
- Pre-authentication integrity: Prevents man-in-the-middle attacks
- AES-128-GCM encryption: Stronger encryption for SMB traffic
- Secure dialect negotiation: Prevents downgrade attacks
- Required for Windows 11: Modern Windows versions prefer SMBv3.1.1
Having SMBv3.1.1 enabled ensures your domain controllers can support the most secure SMB communications.
Control Type
Section titled “Control Type”Preventive
Security Recommendation
Section titled “Security Recommendation”Enable SMBv3.1.1 on all domain controllers running Windows Server 2016 or later to ensure maximum SMB security.
To verify SMBv3.1.1 status:
Get-SmbServerConfiguration | Select-Object EnableSMB3_1_1ProtocolHow the Test Works
Section titled “How the Test Works”This test queries the SMB server configuration on each domain controller to check if SMBv3.1.1 protocol is enabled. It reports the count and names of DCs with this protocol enabled.
Related Tests
Section titled “Related Tests”Test-MtAdDcSmbv1EnabledCount- SMBv1 protocol status (should be disabled)Test-MtAdDcSmbSigningEnabledCount- SMB signing configuration
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.