Hi everyone
A good new if you want to know who still access your server in SMB1, Microsoft just backported the auditing from Windows 2016 into Windows 2012R2 in the latest July 2017 patch 🙂
-
Addressed issue to provide Server Message Block version 1 auditing on Windows Server 2012 R2.
June 27, 2017—KB4022720 (Preview of Monthly Rollup)
An extra – A funny pritnscreen for SMB1 use case..