BLzNFuN
Active member
- Local time
- 8:00 PM
- Posts
- 20
- OS
- Windows 11 Pro x3
Hey all,
I have an older NAS drive and with Windows 11 changes to SMB and configurations, you're most likely frustrated like me. One of the more frustrating things was when you loaded folders on an older NAS drive, the contents would show empty unless you manually refreshed them.
Well with the help of ChatGPT and Gemini, I created this script that does all the work for you so you don't have to search for the solution. Keep in mind, Windows implemented the changes that cause the above issues because they are less secure. So keep in mind when you run this script, it defeats the protections put in place by Windows. But if you know what you are doing or are aware of your internet surroundings, you should be fine.
The script will also do a few more things for you like let you add devices to the "Trusted Intranet Zone" so when you try to run executible files, it won't prompt you with security warnings about "This might not be safe". All you need to know is the device's IP address or Domain/NetBIOS name.
The script will also help you enable SMBv1 (as a last resort if you device is still causing you issues) but keep in mind enabling SMBv1 is an extreme risk and should not be enabled without knowing the risks.
I recommend Notepad++ to copy and paste the following code into a blank text document for each section of code.
Step 1- Create a new folder on your desktop (or where ever you want it) to store your files your going to create.
Step 2 - Inside the new folder you just created, right click and create a new text document using Notepad++. Open the new text file and copy the batch code to blank Notepad++, then click File > Save As and name it what you want and select the dropdown file type, "Batch". Now click "Save".
Step 3 - Inside the new folder you just created, right click and create another new text document using Notepad++. Open the new text file and copy powershell script code to the blank Notepad++, then click File > Save As and name it NAS_SMB_Settings. Click the dropdown file type to save it as a Windows Powershell File. Now click save. You can rename this file to anything you want as well, but then you'll have to update the batch file code to reflect what you called the powershell file.
You should now have four files in the new folder. One is a batch file, one is a powerscript file and the other two were the blank notepad++ files you used to get started. You can safely delete the two Notepad++ text files so you only have the batch file and the powershell script file.
Now run the batch file. It will load the Powershell script elevated so it can control the SMB functions and settings. Upon first run, it will automatically create a "log" folder inside the folder you created. This logs all actions by the script so you should be able to see exactly what the script did.
Once you have this folder with your files on, you can move the folder where ever you want (like a USB Flash Drive) so you can do this on all your PCs and devices that are having issues on your home network or over VPN.
I hope this helps!
Below you'll find the batch file (which elevates the script so you don't have elevate your global script policy) and the script to get you up and running again with your devices.
I have an older NAS drive and with Windows 11 changes to SMB and configurations, you're most likely frustrated like me. One of the more frustrating things was when you loaded folders on an older NAS drive, the contents would show empty unless you manually refreshed them.
Well with the help of ChatGPT and Gemini, I created this script that does all the work for you so you don't have to search for the solution. Keep in mind, Windows implemented the changes that cause the above issues because they are less secure. So keep in mind when you run this script, it defeats the protections put in place by Windows. But if you know what you are doing or are aware of your internet surroundings, you should be fine.
The script will also do a few more things for you like let you add devices to the "Trusted Intranet Zone" so when you try to run executible files, it won't prompt you with security warnings about "This might not be safe". All you need to know is the device's IP address or Domain/NetBIOS name.
The script will also help you enable SMBv1 (as a last resort if you device is still causing you issues) but keep in mind enabling SMBv1 is an extreme risk and should not be enabled without knowing the risks.
I recommend Notepad++ to copy and paste the following code into a blank text document for each section of code.
Step 1- Create a new folder on your desktop (or where ever you want it) to store your files your going to create.
Step 2 - Inside the new folder you just created, right click and create a new text document using Notepad++. Open the new text file and copy the batch code to blank Notepad++, then click File > Save As and name it what you want and select the dropdown file type, "Batch". Now click "Save".
Step 3 - Inside the new folder you just created, right click and create another new text document using Notepad++. Open the new text file and copy powershell script code to the blank Notepad++, then click File > Save As and name it NAS_SMB_Settings. Click the dropdown file type to save it as a Windows Powershell File. Now click save. You can rename this file to anything you want as well, but then you'll have to update the batch file code to reflect what you called the powershell file.
You should now have four files in the new folder. One is a batch file, one is a powerscript file and the other two were the blank notepad++ files you used to get started. You can safely delete the two Notepad++ text files so you only have the batch file and the powershell script file.
Now run the batch file. It will load the Powershell script elevated so it can control the SMB functions and settings. Upon first run, it will automatically create a "log" folder inside the folder you created. This logs all actions by the script so you should be able to see exactly what the script did.
Once you have this folder with your files on, you can move the folder where ever you want (like a USB Flash Drive) so you can do this on all your PCs and devices that are having issues on your home network or over VPN.
I hope this helps!
Below you'll find the batch file (which elevates the script so you don't have elevate your global script policy) and the script to get you up and running again with your devices.
Batch:
@echo off
:: -----------------------------
:: Launch NAS_SMB_Settings.ps1 with admin rights
:: -----------------------------
set ScriptDir=%~dp0
powershell -NoProfile -ExecutionPolicy Bypass -Command "Start-Process powershell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File \"%ScriptDir%NAS_SMB_Settings.ps1\"' -Verb RunAs"
exit
Powershell:
# ====================================================
# NAS / SMB Configuration Script - Portable
# Console Tracking
# Created using ChatGPT & Gemini by Jeremy / BLzNFuN
# [email protected]
# ====================================================
# Force all errors to be terminating to ensure they are caught
$ErrorActionPreference = "Stop"
# --- Global Variables ---
# This file is used to persist the reboot state across script sessions.
$RebootTrackerFile = Join-Path (Join-Path $PSScriptRoot "log") "reboot_required.txt"
$LastPCFile = Join-Path (Join-Path $PSScriptRoot "log") "last_run_pc.txt"
# --- Functions ---
function Write-Log { param([string]$Message)
$timestamp = Get-Date -Format "yyyy-MM-dd hh:mm:ss tt"
$computerName = $env:COMPUTERNAME
"[INFO] $timestamp [$computerName] - $Message" | Out-File -FilePath $LogFile -Append -Encoding UTF8
}
function Show-Message { param([string]$Message,[ValidateSet("Info","Warning","Error","Success")][string]$Type="Info")
switch ($Type) {
"Info" { Write-Host $Message -ForegroundColor White -BackgroundColor Blue }
"Warning" { Write-Host $Message -ForegroundColor Yellow -BackgroundColor Blue }
"Error" { Write-Host $Message -ForegroundColor Red -BackgroundColor Blue }
"Success" { Write-Host $Message -ForegroundColor Green -BackgroundColor Blue }
}
}
function Get-IntranetRegPaths {
# We will always use the HKCU drive as it is the most reliable.
# When run as an administrator, it points to the administrator's registry hive.
$paths = @{
Domains = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains"
Ranges = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"
}
return $paths
}
# --- Local Intranet Functions ---
function Get-AllIntranetEntries {
$entries = @()
$regPaths = Get-IntranetRegPaths
try {
# Check for existence of the Domains key before trying to get child items
if (Test-Path $regPaths.Domains) {
$domainKeys = Get-ChildItem -Path $regPaths.Domains -ErrorAction SilentlyContinue
foreach ($key in $domainKeys) {
# Use PSChildName to get just the domain name, not the full path
$entries += $key.PSChildName.ToLower()
}
}
# Check for existence of the Ranges key before trying to get child items
if (Test-Path $regPaths.Ranges) {
$rangeKeys = Get-ChildItem -Path $regPaths.Ranges -ErrorAction SilentlyContinue
foreach ($key in $rangeKeys) {
try {
$props = Get-ItemProperty -Path $key.PSPath -ErrorAction Stop
# Check for the correct ":Range" key first
if ($props.PSObject.Properties.Name -contains ":Range") {
$entries += ([string]$props.":Range").Trim().ToLower()
}
# Also check for the old "URL" key for backward compatibility
elseif ($props.PSObject.Properties.Name -contains "URL") {
$entries += ([string]$props.URL).Trim().ToLower()
}
} catch {
Write-Log "ERROR: Failed to retrieve range entry from $($key.PSPath). $($_.Exception.Message)"
}
}
}
} catch {
Write-Log "ERROR: Failed to retrieve all intranet entries. $($_.Exception.Message)"
}
return $entries
}
function Validate-NASDevice { param([string]$Device)
# Check for IP address format. If it matches, it's a valid IP.
if ($Device -match "^\d{1,3}(\.\d{1,3}){3}$") {
return $true
}
# Check for hostname format. This now excludes pure numerical strings.
elseif ($Device -notmatch "^[\d.]+$" -and $Device -match "^[A-Za-z0-9\-_.]+$") {
return $true
}
else {
Show-Message "Invalid Local Intranet entry format: $Device" "Error"
return $false
}
}
function Add-LocalIntranetEntry { param([string]$device)
try {
$normalizedDevice = $device.Trim().ToLower()
# Check if entry already exists in either location
$existingEntries = Get-AllIntranetEntries
if ($existingEntries -contains $normalizedDevice) {
Show-Message "$device already exists." "Info"
return
}
$regPaths = Get-IntranetRegPaths
if ($normalizedDevice -match "^\d{1,3}(\.\d{1,3}){3}$") { # IP Address
$regPath = $regPaths.Ranges
# Find the highest existing Range number and add one
$nextRangeNumber = 0
$existingRanges = Get-ChildItem -Path $regPath -ErrorAction SilentlyContinue | Where-Object { $_.PSChildName -match '^Range\d+$' }
if ($existingRanges) {
$numbers = $existingRanges | ForEach-Object { [int]($_.PSChildName -replace '^Range') }
$nextRangeNumber = ($numbers | Measure-Object -Maximum).Maximum + 1
}
$rangeKey = Join-Path -Path $regPath -ChildPath "Range$nextRangeNumber"
if (-not (Test-Path $rangeKey)) { New-Item -Path $rangeKey -Force | Out-Null }
# Use the correct ":Range" property name as per Windows GUI.
New-ItemProperty -Path $rangeKey -Name ":Range" -Value $device -Force | Out-Null
# Add the "*" dword value with data 1 to match the GUI behavior.
New-ItemProperty -Path $rangeKey -Name "*" -Value 1 -Type DWORD -Force | Out-Null
} else { # Domain Name
$regPath = $regPaths.Domains
$domainKey = Join-Path -Path $regPath -ChildPath $normalizedDevice
# Simply creating the key is sufficient.
if (-not (Test-Path $domainKey)) { New-Item -Path $domainKey -Force | Out-Null }
# Add the "*" dword value with data 1 to match the GUI behavior.
New-ItemProperty -Path $domainKey -Name "*" -Value 1 -Type DWORD -Force | Out-Null
}
Write-Log "Local Intranet entry added: $device"
Show-Message "$device successfully added." "Success"
} catch {
Show-Message "Failed to add $device. Check log for details." "Error"
Write-Log "ERROR: Failed to add $device - $($_.Exception.Message)"
}
}
function Remove-LocalIntranetEntry { param([string]$device)
$found = $false
$normalizedDevice = $device.Trim().ToLower()
$regPaths = Get-IntranetRegPaths
try {
# Check Domains
if ($normalizedDevice -notmatch "^\d{1,3}(\.\d{1,3}){3}$") {
$domainPath = Join-Path -Path $regPaths.Domains -ChildPath $normalizedDevice
if (Test-Path $domainPath) {
Remove-Item -Path $domainPath -Recurse -Force -ErrorAction Stop
$found = $true
Show-Message "$device successfully removed." "Success"
Write-Log "Removed Local Intranet entry: $device"
}
}
# Check Ranges
$rangeKeys = Get-ChildItem -Path $regPaths.Ranges -ErrorAction SilentlyContinue
foreach ($key in $rangeKeys) {
try {
$props = Get-ItemProperty -Path $key.PSPath -ErrorAction Stop
# Check for the correct ":Range" property first
if ($props.PSObject.Properties.Name -contains ":Range" -and $props.":Range".Trim().ToLower() -eq $normalizedDevice) {
Remove-Item -Path $key.PSPath -Recurse -Force -ErrorAction Stop
$found = $true
Show-Message "$device successfully removed." "Success"
Write-Log "Removed Local Intranet entry: $device"
}
# Also check for the old "URL" property for backward compatibility
elseif ($props.PSObject.Properties.Name -contains "URL" -and $props.URL.Trim().ToLower() -eq $normalizedDevice) {
Remove-Item -Path $key.PSPath -Recurse -Force -ErrorAction Stop
$found = $true
Show-Message "$device successfully removed." "Success"
Write-Log "Removed Local Intranet entry: $device"
}
} catch {
Write-Log "ERROR: Failed to remove entry - $($_.Exception.Message)"
}
}
if (-not $found) { Show-Message "$device not found." "Error" }
} catch {
Write-Log "ERROR: Failed to remove intranet entries - $($_.Exception.Message)"
}
}
function Remove-AllIntranetEntries {
Clear-Host
Show-Message "--- Remove ALL Trusted Local Intranet Devices From This PC ---" "Info"
Write-Host ""
$currentEntries = Get-AllIntranetEntries
Show-Message "The following devices will be removed:" "Info"
Write-Host ""
if ($currentEntries.Count -gt 0) {
foreach ($d in $currentEntries) { Show-Message " - $d" "Warning" }
} else {
Show-Message " No trusted devices found." "Info"
Read-Host "`nPress Enter to return to main menu..." | Out-Null
return
}
Write-Host ""
$confirm = Read-Host "Are you sure you want to remove ALL listed devices? This includes devices added from other sources. (Y/N)"
if ($confirm -match "^[Yy]$") {
try {
$regPaths = Get-IntranetRegPaths
if (Test-Path $regPaths.Domains) {
Remove-Item -Path $regPaths.Domains -Recurse -Force -ErrorAction Stop
Show-Message "All Domain/NetBIOS devices successfully removed." "Success"
Write-Log "All domain entries removed from Local Intranet."
} else {
Show-Message "No domain entries to remove." "Info"
}
if (Test-Path $regPaths.Ranges) {
Remove-Item -Path $regPaths.Ranges -Recurse -Force -ErrorAction Stop
Show-Message "All IP Devices successfully removed." "Success"
Write-Log "All IP range entries removed from Local Intranet."
} else {
Show-Message "No IP range entries to remove." "Info"
}
} catch {
Show-Message "An error occurred while removing devices. Check log for details." "Error"
Write-Log "ERROR: Failed to remove all intranet entries - $($_.Exception.Message)"
}
} else {
Show-Message "No devices were removed." "Info"
}
Read-Host "`nPress Enter to return to main menu..." | Out-Null
}
# --- Menu Functions ---
function Show-CurrentStatus {
Clear-Host
Show-Message "--- Current Status ---" "Info"
Write-Host ""
try {
$smbConfig = Get-SmbClientConfiguration
$smb1Status = Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
# Use string formatting for justified output
Show-Message ("{0,-28}: {1}" -f "RequireSecuritySignature", $smbConfig.RequireSecuritySignature) "Info"
if ($smbConfig.RequireSecuritySignature -eq $false) { Show-Message "(DISABLED - Low security!)" "Warning" }
Show-Message ("{0,-28}: {1}" -f "EnableInsecureGuestLogons", $smbConfig.EnableInsecureGuestLogons) "Info"
if ($smbConfig.EnableInsecureGuestLogons -eq $true) { Show-Message "(ENABLED - Insecure!)" "Warning" }
Show-Message ("{0,-28}: {1}" -f "SMBv1 Status", $smb1Status.State) "Info"
if ($smb1Status.State -eq 'Enabled') { Show-Message "(ENABLED - Insecure!)" "Warning" }
} catch { Show-Message "SMB config not accessible or requires admin." "Warning" }
$allIntranetEntries = Get-AllIntranetEntries
Show-Message "`nTrusted Local Intranet Devices:" "Info"
Write-Host ""
if ($allIntranetEntries.Count -gt 0) {
foreach ($d in $allIntranetEntries) { Show-Message " - $d" "Success" }
} else {
Show-Message " No trusted devices found." "Info"
}
Write-Host "`nPress any key to return to menu..."
$null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
}
function Configure-Option2 {
Clear-Host
Show-Message "--- Current SMB Status ---" "Info"
Write-Host ""
try {
$smbConfig = Get-SmbClientConfiguration
# Use string formatting for justified output
Show-Message ("{0,-28}: {1}" -f "RequireSecuritySignature", $smbConfig.RequireSecuritySignature) "Info"
if ($smbConfig.RequireSecuritySignature -eq $false) { Show-Message "(DISABLED - Low security!)" "Warning" }
Show-Message ("{0,-28}: {1}" -f "EnableInsecureGuestLogons", $smbConfig.EnableInsecureGuestLogons) "Info"
if ($smbConfig.EnableInsecureGuestLogons -eq $true) { Show-Message "(ENABLED - Insecure!)" "Warning" }
} catch { Show-Message "SMB config not accessible or requires admin." "Warning" }
Write-Host "`n-------------------------------------`n"
Show-Message "--- SMB Configuration Options ---" "Info"
Write-Host ""
Show-Message "1) Apply Less Secure Settings" "Info"
Write-Host
Show-Message " - WARNING: This will make SMB less secure!" "Warning"
Show-Message " - ENABLE guest logins (may allow unauthenticated access to shares)" "Warning"
Show-Message " - DISABLE security signature (reduces protection against man-in-the-middle attacks)" "Warning"
Write-Host
Show-Message "2) Revert to Windows Default" "Info"
Write-Host
Show-Message " - Restore default, secure settings" "Success"
Show-Message " - DISABLE guest logins" "Success"
Show-Message " - ENABLE security signature" "Success"
Write-Host
while ($true) {
$selection = Read-Host "Select an option (1 or 2, or leave blank and press Enter to return to main menu)"
# Check for empty input (user just pressed Enter)
if ([string]::IsNullOrWhiteSpace($selection)) {
break # Exit the loop and the function returns to the main menu
}
switch ($selection) {
"1" {
if ($smbConfig.EnableInsecureGuestLogons -eq $true -and $smbConfig.RequireSecuritySignature -eq $false) {
Show-Message "Less secure settings are already in effect." "Warning"
} else {
$confirm = Read-Host "Are you sure you wish to apply LESS SECURE settings? (Y/N)"
if ($confirm -match "^[Yy]$") {
try {
Set-SmbClientConfiguration -EnableInsecureGuestLogons $true -RequireSecuritySignature $false -Force | Out-Null
Show-Message "SMB configuration updated: guest logins enabled, security signature disabled" "Warning"
Write-Log "SMB configuration updated via Option 2 (Less Secure) - REBOOT REQUIRED"
Set-Content -Path $RebootTrackerFile -Value "Reboot Required"
Show-Message "`nA reboot is required to apply these changes." "Warning"
} catch {
Show-Message "Failed to update SMB configuration. Check log for details." "Error"
Write-Log "ERROR: Option 2 (Less Secure) failed - $($_.Exception.Message)"
}
} else { Show-Message "No changes applied." "Info" }
}
break # Exit the loop after a valid selection is made
}
"2" {
if ($smbConfig.EnableInsecureGuestLogons -eq $false -and $smbConfig.RequireSecuritySignature -eq $true) {
Show-Message "Windows Default settings are already in effect." "Info"
} else {
$confirm = Read-Host "Are you sure you wish to REVERT to Windows Default settings? (Y/N)"
if ($confirm -match "^[Yy]$") {
try {
Set-SmbClientConfiguration -EnableInsecureGuestLogons $false -RequireSecuritySignature $true -Force | Out-Null
Show-Message "SMB configuration reverted to Windows Default." "Success"
Write-Log "SMB configuration reverted to Windows Default - REBOOT REQUIRED"
Set-Content -Path $RebootTrackerFile -Value "Reboot Required"
Show-Message "`nA reboot is required to apply these changes." "Warning"
} catch {
Show-Message "Failed to revert SMB configuration. Check log for details." "Error"
Write-Log "ERROR: Option 2 (Windows Default) failed - $($_.Exception.Message)"
}
} else { Show-Message "No changes applied." "Info" }
}
break # Exit the loop after a valid selection is made
}
Default { Show-Message "Invalid selection." "Warning"; Start-Sleep 0 } # Stays in the loop on invalid input
}
}
}
function Configure-Smb1 {
Clear-Host
Show-Message "--- Configure SMBv1 ---" "Info"
Write-Host ""
try {
$smb1Status = Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
Show-Message ("Current SMBv1 Status: {0}" -f $smb1Status.State) "Info"
if ($smb1Status.State -eq 'Enabled') { Show-Message "(SMBv1 is a legacy, insecure protocol. Use with caution!)" "Warning" }
Write-Host ""
} catch {
Show-Message "Failed to check SMBv1 status. Check log for details." "Error"
Write-Log "ERROR: Failed to get SMBv1 status - $($_.Exception.Message)"
}
Show-Message "`n-------------------------------------`n"
Show-Message "Enabling SMBv1 is a LAST RESORT for connecting to very old NAS devices." "Warning"
Show-Message "It is highly insecure and can expose your network to threats like WannaCry." "Warning"
Show-Message "`nA reboot is required to apply these changes.`n" "Warning"
Show-Message "1) Enable SMBv1 (Insecure)" "Warning"
Show-Message "2) Disable SMBv1 (Recommended)" "Info"
Write-Host ""
while ($true) {
$selection = Read-Host "Select an option (1 or 2, or leave blank and press Enter to return to main menu)"
if ([string]::IsNullOrWhiteSpace($selection)) {
break
}
switch ($selection) {
"1" {
try {
if ($smb1Status.State -eq 'Enabled') {
Show-Message "SMBv1 is already enabled." "Warning"
} else {
$confirm = Read-Host "Are you sure you want to ENABLE the insecure SMBv1 protocol? (Y/N)"
if ($confirm -match "^[Yy]$") {
Enable-WindowsOptionalFeature -Online -FeatureName "SMB1Protocol" -NoRestart -ErrorAction Stop | Out-Null
Show-Message "SMBv1 is now enabled. A reboot is required." "Warning"
Write-Log "SMBv1 enabled - REBOOT REQUIRED"
Set-Content -Path $RebootTrackerFile -Value "Reboot Required"
} else { Show-Message "No changes applied." "Info" }
}
} catch {
Show-Message "Failed to enable SMBv1. Check log for details." "Error"
Write-Log "ERROR: Failed to enable SMBv1 - $($_.Exception.Message)"
}
break
}
"2" {
try {
if ($smb1Status.State -eq 'Disabled') {
Show-Message "SMBv1 is already disabled." "Info"
} else {
$confirm = Read-Host "Are you sure you want to DISABLE SMBv1? (Y/N)"
if ($confirm -match "^[Yy]$") {
Disable-WindowsOptionalFeature -Online -FeatureName "SMB1Protocol" -NoRestart -ErrorAction Stop | Out-Null
Show-Message "SMBv1 is now disabled. A reboot is required." "Success"
Write-Log "SMBv1 disabled - REBOOT REQUIRED"
Set-Content -Path $RebootTrackerFile -Value "Reboot Required"
} else { Show-Message "No changes applied." "Info" }
}
} catch {
Show-Message "Failed to disable SMBv1. Check log for details." "Error"
Write-Log "ERROR: Failed to disable SMBv1 - $($_.Exception.Message)"
}
break
}
Default { Show-Message "Invalid selection." "Warning"; Start-Sleep 0 }
}
}
}
function Add-LocalIntranetEntries {
Clear-Host
Show-Message "--- Add Trusted Local Intranet Devices To This PC ---" "Info"
Write-Host ""
Show-Message "Current trusted devices are:" "Info"
Write-Host ""
$currentEntries = Get-AllIntranetEntries
if ($currentEntries.Count -gt 0) {
foreach ($d in $currentEntries) { Show-Message " - $d" "Success" }
} else {
Show-Message " No trusted devices found." "Info"
}
Show-Message "`nEnter IP addresses or NAS/NetBIOS names below." "Info"
Show-Message "Separate multiple entries by commas or hit Enter for each device." "Info"
Show-Message "Leave blank and press Enter to return to main menu." "Info"
while ($true) {
Write-Host ""
$inputDevices = Read-Host "Enter device(s)"
if ([string]::IsNullOrWhiteSpace($inputDevices)) { break }
$devices = $inputDevices -split ","
foreach ($d in $devices) {
$d = $d.Trim()
if ($d -ne "") {
if (Validate-NASDevice $d) { Add-LocalIntranetEntry $d }
}
}
}
}
function Remove-LocalIntranetEntries {
Clear-Host
Show-Message "--- Remove Trusted Local Intranet Devices From This PC ---" "Info"
Write-Host ""
Show-Message "Current trusted devices are:" "Info"
Write-Host ""
$currentEntries = Get-AllIntranetEntries
if ($currentEntries.Count -gt 0) {
foreach ($d in $currentEntries) { Show-Message " - $d" "Success" }
} else {
Show-Message " No trusted devices found." "Info"
}
Show-Message "`nEnter IP addresses or NAS/NetBIOS names below to remove." "Info"
Show-Message "Separate multiple entries by commas or hit Enter for each device." "Info"
Show-Message "Leave blank and press Enter to return to main menu." "Info"
Write-Host ""
while ($true) {
$inputDevices = Read-Host "Enter device(s)"
if ([string]::IsNullOrWhiteSpace($inputDevices)) { break }
$devices = $inputDevices -split ","
foreach ($d in $devices) {
$d = $d.Trim()
if ($d -ne "") { Remove-LocalIntranetEntry $d }
}
}
}
function List-AllIntranetEntries {
Clear-Host
Show-Message "--- All Trusted Local Intranet Entries ---" "Info"
Write-Host ""
Show-Message "Current trusted devices are:" "Info"
Write-Host ""
$allEntries = Get-AllIntranetEntries
if ($allEntries.Count -gt 0) {
foreach ($entry in $allEntries) { Show-Message " - $entry" "Success" }
} else { Show-Message " No trusted devices found." "Info" }
Write-Host "`nPress any key to return to menu..."
$null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
}
function Revert-ToWindowsDefaults {
Clear-Host
Show-Message "--- Revert All SMB Configuration Settings and SMBv1 Settings to Windows Defaults ---" "Info"
Write-Host ""
# Show current status before asking for confirmation
try {
$smbConfig = Get-SmbClientConfiguration
$smb1Status = Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
Show-Message "Current SMB and SMBv1 Status:" "Info"
Write-Host ""
Show-Message ("{0,-28}: {1}" -f "RequireSecuritySignature", $smbConfig.RequireSecuritySignature) "Info"
Show-Message ("{0,-28}: {1}" -f "EnableInsecureGuestLogons", $smbConfig.EnableInsecureGuestLogons) "Info"
Show-Message ("{0,-28}: {1}" -f "SMBv1 Status", $smb1Status.State) "Info"
} catch {
Show-Message "Failed to retrieve current status. Check log for details." "Error"
Write-Log "ERROR: Failed to get current status in Revert-ToWindowsDefaults - $($_.Exception.Message)"
}
Write-Host "`n-------------------------------------`n"
Show-Message "This will revert your system to the default, more secure settings." "Success"
Show-Message "This includes disabling insecure guest logins, enabling security signatures, and disabling SMBv1." "Success"
Write-Host ""
$confirm = ""
do {
$confirm = Read-Host "Are you sure you want to revert all SMB settings to Windows defaults? (Y/N)"
if ($confirm -notmatch "^[YyNn]$") {
Show-Message "Invalid selection. Please enter Y or N." "Warning"
}
} while ($confirm -notmatch "^[YyNn]$")
if ($confirm -match "^[Yy]$") {
$changesMade = $false
try {
# Revert less secure settings
if ($smbConfig.EnableInsecureGuestLogons -eq $true -or $smbConfig.RequireSecuritySignature -eq $false) {
Set-SmbClientConfiguration -EnableInsecureGuestLogons $false -RequireSecuritySignature $true -Force | Out-Null
Show-Message "`nSMB configuration reverted to Windows Default." "Success"
$changesMade = $true
} else {
Show-Message "`nSMB client settings are already at Windows defaults." "Info"
}
# Revert SMBv1
if ($smb1Status.State -eq 'Enabled') {
Disable-WindowsOptionalFeature -Online -FeatureName "SMB1Protocol" -NoRestart -ErrorAction Stop | Out-Null
Show-Message "SMBv1 is now disabled." "Success"
$changesMade = $true
} else {
Show-Message "SMBv1 is already disabled." "Info"
}
} catch {
Show-Message "Failed to revert settings. Check log for details." "Error"
Write-Log "ERROR: Failed to revert to Windows defaults - $($_.Exception.Message)"
}
if ($changesMade) {
Set-Content -Path $RebootTrackerFile -Value "Reboot Required"
Show-Message "`nA reboot is required to apply these changes." "Warning"
}
} else {
Show-Message "`nReversion cancelled. No changes were made." "Info"
}
Read-Host "`nPress Enter to return to main menu..." | Out-Null
}
# --- Main Script Logic ---
try {
# --- Setup ---
chcp 65001 >$null
[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
[Console]::InputEncoding = [System.Text.Encoding]::UTF8
If (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
Write-Host "ERROR: Script must be run as Administrator!" -ForegroundColor Red -BackgroundColor Blue
Read-Host "Press Enter to exit..." | Out-Null
Exit
}
$exitRequested = $false
$Host.UI.RawUI.BackgroundColor = "Blue"
$Host.UI.RawUI.ForegroundColor = "White"
Clear-Host
$logFolder = Join-Path $PSScriptRoot "log"
if (-not (Test-Path $logFolder)) { New-Item -ItemType Directory -Path $logFolder | Out-Null }
$LogFile = Join-Path $logFolder "NAS_Script.log"
# --- New PC Logging Check ---
$currentComputerName = $env:COMPUTERNAME
$lastKnownComputerName = ""
if (Test-Path $LastPCFile) {
$lastKnownComputerName = Get-Content $LastPCFile
}
if ($lastKnownComputerName -ne $currentComputerName) {
" " | Out-File -FilePath $LogFile -Append -Encoding UTF8
" " | Out-File -FilePath $LogFile -Append -Encoding UTF8
" " | Out-File -FilePath $LogFile -Append -Encoding UTF8
Write-Log "New PC detected. Starting new log session."
Set-Content -Path $LastPCFile -Value $currentComputerName
}
# --- Reboot Check ---
if (Test-Path $RebootTrackerFile) {
$fileCreationTime = (Get-Item $RebootTrackerFile).LastWriteTime
$currentBootTime = (Get-CimInstance -ClassName Win32_OperatingSystem).LastBootUpTime
# Compare last boot time to the file's last write time.
if ($currentBootTime -gt $fileCreationTime) {
Remove-Item -Path $RebootTrackerFile -ErrorAction SilentlyContinue
} else {
Write-Host ""
Show-Message "WARNING: A reboot is still required to apply a previous change. Main menu is loading, please wait." "Warning"
Write-Log "WARNING: A previous change was made that requires a reboot."
Start-Sleep -Seconds 6
}
}
# --- Main Menu Loop ---
while (-not $exitRequested) {
Clear-Host
if (Test-Path $RebootTrackerFile) {
Show-Message "WARNING: A REBOOT IS REQUIRED" "Warning"
Write-Host ""
}
Show-Message "--- NAS / SMB Configuration Script ---" "Success"
Write-Host ""
Show-Message "IMPORTANT: Some changes will require a reboot. Please save all your work before proceeding." "Warning"
Write-Host ""
Show-Message ("{0,2}) {1}" -f 1, "Show current SMB and Trusted Local Intranet status.") "Info"
Show-Message ("{0,2}) {1}" -f 2, "Configure SMB (Fixes folder refresh, etc.)") "Info"
Show-Message ("{0,2}) {1}" -f 3, "Configure SMBv1 (Final resort for legacy devices)") "Info"
Write-Host ""
Show-Message ("{0,2}) {1}" -f 4, "List All Trusted Local Intranet Entries On This PC") "Info"
Show-Message ("{0,2}) {1}" -f 5, "Add Trusted Local Intranet Entries To This PC (Helps Prevent Security Warnings)") "Info"
Show-Message ("{0,2}) {1}" -f 6, "Remove Trusted Local Intranet Entries From This PC") "Info"
Write-Host ""
Show-Message ("{0,2}) {1}" -f 7, "Remove ALL Trusted Devices From This PC") "Info"
Write-Host ""
Show-Message ("{0,2}) {1}" -f 8, "Revert All SMB Configuration Settings and SMBv1 Settings to Windows Defaults.") "Info"
Write-Host ""
Show-Message ("{0,2}) {1}" -f 9, "Exit (Reboot Manually If Required)") "Info"
Show-Message ("{0,2}) {1}" -f 10, "Exit and Reboot (If Required)") "Info"
Write-Host ""
$selection = Read-Host "`nSelect an option (1-10)"
switch ($selection) {
"1" { Show-CurrentStatus }
"2" { Configure-Option2 }
"3" { Configure-Smb1 }
"4" { List-AllIntranetEntries }
"5" { Add-LocalIntranetEntries }
"6" { Remove-LocalIntranetEntries }
"7" { Remove-AllIntranetEntries }
"8" { Revert-ToWindowsDefaults }
"9" {
if (Test-Path $RebootTrackerFile) {
Show-Message "`n--- REBOOT REQUIRED ---`n" "Warning"
Show-Message "A reboot is required to apply the changes you made to SMB settings.`n" "Warning"
Show-Message "Please save all your work before manually rebooting your computer.`n" "Warning"
$confirm = Read-Host "Do you wish to exit the script? (Y/N)"
if ($confirm -match "^[Yy]$") {
$exitRequested = $true
}
} else {
Show-Message "`nNo reboot is required. No SMB changes were made that need a reboot.`n" "Success"
$confirm = Read-Host "Do you wish to exit the script? (Y/N)"
if ($confirm -match "^[Yy]$") {
$exitRequested = $true
}
}
}
"10" {
if (Test-Path $RebootTrackerFile) {
Show-Message "`n--- REBOOTING TO APPLY CHANGES ---`n" "Warning"
Show-Message "A reboot is required to apply the changes you made to SMB settings.`n" "Warning"
Show-Message "You will lose any unsaved work if you proceed now! Please save your work now!`n" "Warning"
$confirm = Read-Host "Are you sure you wish to reboot now? (Y/N)"
if ($confirm -match "^[Yy]$") {
Show-Message "Press Enter to reboot..." "Info"
Read-Host | Out-Null
Restart-Computer
$exitRequested = $true
} else {
Show-Message "Reboot cancelled." "Info"
$confirmExit = Read-Host "Do you still wish to exit the script? (Y/N)"
if ($confirmExit -match "^[Yy]$") {
$exitRequested = $true
}
}
} else {
Show-Message "`nNo reboot is required. No SMB changes were made that need a reboot.`n" "Success"
$confirm = Read-Host "Do you wish to exit the script? (Y/N)"
if ($confirm -match "^[Yy]$") {
$exitRequested = $true
}
}
}
Default { Show-Message "Invalid selection." "Warning"; Start-Sleep 1 }
}
}
} catch {
Clear-Host
Write-Host "FATAL ERROR: A critical error occurred and the script was forced to exit." -ForegroundColor Red -BackgroundColor Blue
Write-Host "`nError Details:" -ForegroundColor Yellow -BackgroundColor Blue
Write-Host $_ -ForegroundColor Yellow -BackgroundColor Blue
Write-Host "`nThis indicates a problem with the system's PowerShell environment or a Windows component." -ForegroundColor White -BackgroundColor Blue
Read-Host "`nPress Enter to exit..." | Out-Null
}
Last edited:
My Computer
At a glance
Windows 11 Pro x3i9-14900K / i9-14900HX / AMD Z1E64 GSkill / 64 Gskill / 24EVGA 3080 Ultra FTW 3 / 4070 Mobile / Z1E
- OS
- Windows 11 Pro x3
- Computer type
- PC/Desktop
- Manufacturer/Model
- Asus / Asus / Asus
- CPU
- i9-14900K / i9-14900HX / AMD Z1E
- Motherboard
- Asus Apex Encore / Asus G16 (2024) / ROG Ally X
- Memory
- 64 GSkill / 64 Gskill / 24
- Graphics Card(s)
- EVGA 3080 Ultra FTW 3 / 4070 Mobile / Z1E
- Sound Card
- Logitech G Pro
- Screen Resolution
- 2560 x 1080 / 2560 x 1600 / 1920 x 1080
- Hard Drives
- 990 pro 4 TB, 4x 980 1TB, 980 pro 2TB
