Heya folks, Ned here again. With the release of Windows 11 Insider Preview Build 25314, we have started disabling the Remote Mailslot protocol by default. This is a precursor to deprecation and eventual removal from Windows. You aren’t using this extremely legacy protocol unless you’re also using the deprecated and disabled-by-default SMB1 protocol, so 99.97% of you have nothing to worry about. For those who are, a bit more information:
Remote Mailslots
The Remote Mailslot protocol is a very old, simple, unreliable, insecure inter-process communication method. A server creates a mailslot and a client writes messages to it using NetBIOS datagrams as a transport when operating over a network with Windows. The sender of the mailslot message formats the SMB_COM_TRANSACTION message and sends it as a NetBIOS datagram. The Proto-SMB1 Common Internet File System (CIFS) Browser Protocol uses “MAILSLOTLANMAN” and “MAILSLOTBROWSE”, for instance.
Mailslots are older than Windows NT, dating back to LAN Manager DOS days. It goes without saying that this protocol is disgusting. If you’ve been an IT Pro for a few decades, you might recall people using the anonymous NET SEND command (MAILSLOTMessngr) to broadcast important messages to all logged on users, or more likely, this kind of crap:
What changed
Starting with Windows 11 Insider Preview Build 25314, remote mailslot is disabled by default. If you have manually re-enabled SMB1 (which has been disabled by default since Windows 10) and some application is still using a Remote Mailslot, they will see one of the following errors:
3025
ERROR_REMOTE_MAILSLOTS_DEPRECATED
“The requested operation failed. Remote mailslots have been deprecated.”
Contact your vendor about updating their software to join the 21st century, as it both requires SMB1 and Remote Mailslot. This protocol is not secure, was replaced decades ago by better technology, and should not be used under any circumstances.
If you need to re-enable Remote Mailslots temporarily while you yell at your vendor or developer, use the following PowerShell command:
PS C:> Set-SmbClientConfiguration -EnableMailslots $true
Remote Mailslots will get officially deprecated in the next release of Windows and Windows Server, meaning that it can eventually be removed altogether. That will take time and there will be plenty of public warning, just like SMB1 had.
Last thought
By now you’ve noticed a trend in Windows Insider and my blog posts here of many new SMB security features coming out.
SMB insecure guest auth now off by default in Windows Insider Pro editions
SMB authentication rate limiter now on by default in Windows Insider
SMB1 now disabled by default for Windows 11 Home Insiders builds
This is the tip of the iceberg – many more are underway, some big, others as radical as the end of SMB1 itself. Check back here often for more in the coming year as these flow into Insiders for your feedback and evaluation.
– Ned Pyle