One scanner fleet keeps SMBv1 alive for 600 hosts - how do you actually retire the protocol?

## Why this is not a technical question Everything technical about retiring a legacy protocol is easy. The setting is one line, the removal is one optional feature, and both are well documented. What makes this a lead's question is that the last consumer is a physical object owned by somebody who did not ask for a hardening programme and has no budget line for it. So the answer has to be shaped like a purchase, not like a change ticket. ## Step one: find the single consumer The framing '600 hosts still allow SMBv1' is almost always wrong, and challenging it is the first thing a strong answer does. Six hundred hosts do not each independently need the protocol. One device family does - a multifunction scanner that writes scans to a share, a badge controller, a camera recorder - and the fleet-wide permissive setting exists because somebody once needed the scanner to work and the fastest fix was the broadest one. The question to answer is therefore: **which single device is holding this open, and for how many hosts?** That reframes a 600-host hardening problem into a one-device procurement problem, and it is the reframe the interviewer is listening for. ## Step two: check the cheap exit first Before costing hardware, establish whether the vendor has a firmware release that speaks something modern. Appliance vendors frequently do, several years late, and the upgrade is a fraction of a replacement. This step is skipped surprisingly often because the device is treated as an immovable object rather than as a supported product with a release stream. ## Step three: cost it as capital, and give it an owner who can refuse If the device cannot be upgraded, retirement means replacing it. That is capital spend against the budget that owns the device - facilities, print services, physical security - not against the security budget, which usually cannot buy scanners. The output of this step is a named owner, a number, and a date. The named owner matters more than the date, and this is the part inexperienced answers miss: the owner must be someone who is allowed to **refuse**. An exception nobody can refuse is not a decision, it is a drift. If the print services owner looks at the number and says 'not this financial year', that is a legitimate outcome, and now the risk is held by someone who can actually trade it against other spending. What is not legitimate is the exception existing with no name attached. ## Step four: narrow the exception while you wait Almost always the money does not land immediately, so the interim matters. The move is to shrink the exception from the estate to the device: - the permissive setting applies to the one host or the one device, not fleet-wide; - everywhere else the feature is uninstalled rather than disabled, so the exception cannot silently re-spread through a policy scope change; - the device's reachability is cut to only the share and the hosts it genuinely needs; - the exception carries an expiry, so it comes back for a decision instead of becoming permanent. On a flat office segment this last point is doing real work, because the neighbours of that scanner are badge controllers and cameras, and an adversary who wants publicity rather than depth is perfectly happy with a camera feed as the objective. 'It is only a printer' undervalues both the device and the company it keeps. ## Step five: expect the setting to be undone The reason the interim must be a narrowed *removal* elsewhere rather than a broad *disable* is behavioural. The vendor's field engineer holds delegated administration so they can service the fleet. When a device breaks after a hardening change, they will restore whatever makes it work, without malice and without telling anyone. A disabled dialect survives that for exactly as long as nobody needs the scanner. An uninstalled component does not silently come back. ## What a weak answer sounds like 'We disable it fleet-wide and grant an exception for the scanner.' That is the same permissive state described more politely, it has no owner, no date and no purchase behind it, and in two years it will still be there with everyone believing the protocol was retired. The whole point of the disabled-versus-removed distinction is that only one of those two states is a claim you can still defend after somebody else has had administrative rights for two years.