Microsoft's edit · SMB interception defenses

44 ms.topic: conceptual

55 author: robinharwood

66 ms.author: roharwoo

7 −ms.date: 08/10/2022

7 +ms.date: 09/14/2022

88 # Customer Intent: As a system or security administrator, I want to prevent SMB interception

99 # attacks, so that I can mitigate security risks within my environment

1010 ---

1818 ## What is an interception attack?

1919

2020 An adversary-in-the-middle (AITM) attack intends to modify the network communication between a

21 −client and server, allowing a threat actor to intercept traffic, this is known as interception.

22 −After interception, a malicious actor may have the ability to spoof, tamper, disclose, or deny

23 −access to your organizations data or account credentials.

21 +client and server, allowing a threat actor to intercept traffic. After interception, a malicious

22 +actor may have the ability to spoof, tamper, disclose, or deny access to your organizations data or

23 +account credentials.

2424

2525 Many organizations rely on SMB to share files between users and to support other applications or

2626 technologies like Active Directory Domain Services. With such broad adoption, SMB is both a popular

2727 target for attackers and has the potential for business-wide impact.

2828

29 −For example, an intercept attack might be for industrial or state-level espionage, extortion, or

29 +For example, an AITM attack might be used for industrial or state-level espionage, extortion, or

3030 finding sensitive security data stored in files. It could also be used as part of a wider attack to

3131 enable the attacker to move laterally within your network or to target multiple endpoints.

3232

3636 1. Reduce the number of attack methods available.

3737 1. Secure the pathways you present to your users.

3838

39 −Due to the diversity of technology and clients within many organizations, a well-rounded defense will

40 −combine multiple methods and will follow the [Zero Trust](/security/zero-trust/zero-trust-overview)

41 −principles.

39 +Due to the diversity of technology and clients within many organizations, a well-rounded defense

40 +will combine multiple methods and will follow the Zero Trust principles. Learn more about

41 +Zero Trust in the [What is Zero Trust?](/security/zero-trust/zero-trust-overview) article.

4242

4343 Now you'll learn about some of the typical good practice configurations to reduce the risk of SMB

4444 interception.

6262 You can install security updates using a few different methods depending on your organizations

6363 requirements. Typical methods are:

6464

65 +- [Azure Update Management](/azure/automation/update-management/overview)

6566 - [Windows Update](https://support.microsoft.com/windows/get-the-latest-windows-update-7d20e88c-0568-483a-37bc-c3885390d212#WindowsVersion=Windows_11)

6667 - [Windows Server Update Services (WSUS)](../../administration/windows-server-update-services/get-started/windows-server-update-services-wsus.md)

6768 - [Software updates in Endpoint Configuration Manager](/mem/configmgr/sum/understand/software-updates-introduction)

68 −- [Azure Update Management](/azure/automation/update-management/overview)

6969

7070 Consider subscribing to notifications in the

7171 [Microsoft Security Response Center (MSRC) Security Update Guide](https://msrc.microsoft.com/update-guide/).

7979 possible. Starting in the Windows 10 Fall Creators Update and Windows Server 2019, [SMB 1.0 is no

8080 longer installed by default](Troubleshoot/smbv1-not-installed-by-default-in-windows.md).

8181

82 +> [!TIP]

83 +> Windows 10 Home and Windows 10 Pro still contain the SMB 1.0 client by default after a clean

84 +> installation or in-place upgrade. This behavior is changing in Windows 11, you can read more in

85 +> the article

86 +> [SMB1 now disabled by default for Windows 11 Home Insiders builds](https://techcommunity.microsoft.com/t5/storage-at-microsoft/smb1-now-disabled-by-default-for-windows-11-home-insiders-builds/ba-p/3289473).

87 +

8288 Removing SMB 1.0 protects your systems by eliminating several well known security vulnerabilities.

8389 SMB 1.0 lacks the security features of SMB 2.0 and later that help protect against interception. For

8490 example, to prevent a compromised connection SMB 3.0 or later uses pre-authentication integrity,

99105 access or fallback to the guest account by default. You should use SMB 2.0 or higher and disable

100106 the use of SMB guest access on any systems where guest access isn't disabled by default.

101107

108 +> [!TIP]

109 +> Windows 11 Home and Pro editions are unchanged from their previous default behavior; they allow

110 +> guest authentication by default.

111 +

102112 When guest access is disabled, it prevents a malicious actor from creating a server and tricking users

103113 into accessing it using guest access. For example, when a user accesses the spoofed share, their

104 −credentials would fail and SMB 1.0 would fallback to using guest access. Disabling guess access

114 +credentials would fail and SMB 1.0 would fall back to using guest access. Disabling guess access

105115 stops the SMB session from connecting, preventing the user from accessing the share and any

106116 malicious files.

107117

108118 To prevent the use of guest fallback on Windows SMB clients where guest access isn't disabled by

109 −default (including Windows Server), you configure the following group policy:

119 +default (including Windows Server):

110120

121 +# [Group Policy](#tab/group-policy)

122 +

111123 1. Open the **Group Policy Management Console**.

112124 1. In the console tree, select **Computer Configuration > Administrative Templates > Network >

113125 Lanman Workstation**.

114126 1. For the setting, right-click **Enable insecure guest logons** and select **Edit**.

115127 1. Select **Enabled** and select **OK**.

116128

129 +# [PowerShell](#tab/powershell)

130 +

131 +From an elevated PowerShell prompt, run the following commands:

132 +

133 +```powershell

134 +Set-SmbClientConfiguration -EnableInsecureGuestLogons $false -Confirm:$false

135 +```

136 +

137 +---

138 +

117139 To learn more about guest access default behavior, read the article

118140 [Guest access in SMB2 and SMB3 disabled by default in Windows](/troubleshoot/windows-server/networking/guest-access-in-smb2-is-disabled-by-default).

119141

128150 the Webclient could connect to HTTP/80 if WebDAV has been enabled. Any resulting connection would be

129151 unencrypted, regardless of your SMB configuration.

130152

131 −You can use Group Policy Preferences to disable the service on a large number of machines when you're ready to implement. For more information about configuring Group Policy Preferences, see

153 +You can use Group Policy Preferences to disable the service on a large number of machines when

154 +you're ready to implement. For more information about configuring Group Policy Preferences, see

132155 [Configure a Service Item](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732482(v=ws.10)).

133156

134157 ### Restrict outbound SMB destinations

167190 or encrypts the early phases of SMB connections to prevent the tampering of Negotiate and Session

168191 Setup messages by using cryptographic hashing.

169192

170 −Using cryptographic hashing, the client and server can mutually trust the connection and session

193 +Cryptographic hashing means the client and server can mutually trust the connection and session

171194 properties. Pre-authentication integrity supersedes _secure dialect negotiation_ introduced in SMB

172195 3.0. You can’t turn off pre-authentication integrity, but if a client uses an older dialect, it

173196 won’t be used.

174197

175198 You can enhance your security posture further by forcing the use of SMB 3.1.1 as a minimum. To set

176 −the minimum SMB dialect to 3.1.1, you must create registry DWORD values for `MinSMB2Dialect` and

177 −`MaxSMB2Dialect` with `0x000000311` as the value data. The registry values are found in the key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters`.

199 +the minimum SMB dialect to 3.1.1, from an elevated PowerShell prompt, run the following commands:

178200

201 +```powershell

202 +Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" -Name "MinSMB2Dialect" -Value 0x000000311

203 +Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" -Name "MaxSMB2Dialect" -Value 0x000000311

204 +```

205 +

179206 To learn more about how to set the minimum SMB dialect used, see

180207 [Controlling SMB dialects](https://techcommunity.microsoft.com/t5/storage-at-microsoft/controlling-smb-dialects/ba-p/860024?WT.mc_id=ITOPSTALK-blog-abartolo).

181208

191218 > require encryption unless all your machines support SMB 3.0 or later, or are third parties with

192219 > SMB 3 and encryption support. If you configure SMB encryption on clients or UNC paths hosted by

193220 > servers that do not support SMB Encryption, the SMB client will be unable to access the specified

194 −> path.

221 +> path. Also, if you configure your server for SMB encryption and it is accessed by clients that

222 +> don't support it, those clients will again be unable to access the path.

195223

196 −UNC Hardening gives the ability to check UNC paths for mandated security settings and will refuse

197 −to connect if a server couldn't meet them. It's a highly effective tool against spoofing and

198 −tampering because the client can authenticate the identity of the server and validate the

199 −integrity of the SMB payloads.

224 +UNC Hardening gives the ability to check UNC paths for mandated security settings and will refuse to

225 +connect if a server couldn't meet them. Beginning with Windows Server 2016 and Windows 10, UNC

226 +Hardening is enabled by default for SYSVOL and NETLOGON shares on domain controllers. It's a highly

227 +effective tool against spoofing and tampering because the client can authenticate the identity of

228 +the server and validate the integrity of the SMB payloads.

200229

201230 When configuring UNC hardening, you can specify various UNC path patterns. For example:

202231

205234 - `\\*\<Share>` - The configuration entry applies to the share that has the specified name on any server.

206235 - `\\<Server>\*` - The configuration entry applies to any share on the specified server.

207236

208 −You can use Group Policy to apply the UNC Hardened Access feature to a large number of machines when you're ready to implement it. For more information about configuring UNC Hardened Access through Group Policy, see the support article

209 −[KB3000483](https://support.microsoft.com/help/3000483/ms15-011-vulnerability-in-group-policy-could-allow-remote-code-executi?WT.mc_id=ITOPSTALK-blog-abartolo).

237 +You can use Group Policy to apply the UNC Hardened Access feature to a large number of machines when

238 +you're ready to implement it. For more information about configuring UNC Hardened Access through

239 +Group Policy, see the security bulletin

240 +[MS15-011](https://support.microsoft.com/topic/ms15-011-vulnerability-in-group-policy-could-allow-remote-code-execution-february-10-2015-91b4bda2-945d-455b-ebbb-01d1ec191328).

210241

211242 ### Map drives on demand with mandated signing or encryption

212243

223254 to map a drive and the server refuses to honor your requirement for signing or encryption, the drive

224255 mapping will fail rather than connect unsafely.

225256

226 −Learn about the syntax and parameters for the `New-SmbMapping` command in [New-SmbMapping](/powershell/module/smbshare/new-smbmapping) reference article.

257 +Learn about the syntax and parameters for the `New-SmbMapping` command in

258 +[New-SmbMapping](/powershell/module/smbshare/new-smbmapping) reference article.

227259

228260 ### Beyond SMB

229261

232264

233265 Removing NTLM helps to protect you against common attacks like pass-the-hash, brute-force or rainbow

234266 hash tables due to its use of older MD4/MD5 cryptography hash function. NTLM also isn't able to

235 −verify the server identity, unlike more recent protocols like Kerberos, making it vulnerable to

236 −NTLM relay attacks as well. Many of these attacks are well proven but are also mitigated with

237 −Kerberos.

267 +verify the server identity, unlike more recent protocols like Kerberos, making it vulnerable to NTLM

268 +relay attacks as well. Many of these common attacks are easily mitigated with Kerberos.

238269

239 −To learn how to audit NTLM as part of

240 −your effort to begin the transition to Kerberos, see the

270 +To learn how to audit NTLM as part of your effort to begin the transition to Kerberos, see the

241271 [Assessing NTLM usage](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/jj865670(v%3dws.10)?WT.mc_id=ITOPSTALK-blog-abartolo)

242 −article. You can also read learn about detecting insecure protocols using Azure Sentinel in the [Azure Sentinel Insecure Protocols Workbook Implementation Guide](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/azure-sentinel-insecure-protocols-workbook-implementation-guide/ba-p/1197564?WT.mc_id=ITOPSTALK-blog-abartolo) blog article.

272 +article. You can also read learn about detecting insecure protocols using Azure Sentinel in the

273 +[Azure Sentinel Insecure Protocols Workbook Implementation Guide](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/azure-sentinel-insecure-protocols-workbook-implementation-guide/ba-p/1197564?WT.mc_id=ITOPSTALK-blog-abartolo)

274 +blog article.

243275

244276 In parallel to removing NTLM, you should consider adding more layers of protection for offline

245277 and ticket passing attacks. Use the following items as a guide when enhancing Kerberos security.

246278

247 −1. **Enforce long passwords and phrases** - 15 characters or more without dictionary words makes

248 − offline brute force extremely time consuming. Avoiding dictionary attacks with pass phrases makes

249 − that even stronger.

279 +1. **Deploy Windows Hello for Business or smart cards** - Two-factor authentication with Windows

280 + Hello for Business adds an entire new layer of protection. Learn about

281 + [Windows Hello for Business](/windows/security/identity-protection/hello-for-business/hello-overview).

282 +1. **Enforce long passwords and phrases** - We encourage using longer password lengths such as 14

283 + characters or more to reduce your resistance to brute force attacks. You should also avoid common

284 + words or phrases to make your password even stronger.

250285 1. **Deploy Azure AD Password Protection for Active Directory Domain Services** - Use Azure AD

251286 Password Protect to block known weak passwords and terms that are specific to your organization.

252287 To learn more, review

255290 character construction, makes brute force and dictionary attacks to crack passwords incredibly

256291 time consuming. Read about what gMSAs are in the article

257292 [Group Managed Service Accounts Overview](../../security/group-managed-service-accounts/group-managed-service-accounts-overview.md).

258 −1. **Deploy Windows Hello for Business or smart cards** - Two-factor authentication with Windows

259 − Hello for Business adds an entire new layer of protection. Learn about

260 − [Windows Hello for Business](/windows/security/identity-protection/hello-for-business/hello-overview).

261 − TODO: as well as switching to Public Key Cryptography for Initial Authentication (PKINIT) in the

262 − Kerberos protocol instead of just using passwords.

263293 1. **Kerberos Armoring, known as Flexible Authentication Secure Tunneling (FAST)** - FAST prevents

264294 [Kerberoasting](https://www.microsoft.com/security/blog/2020/08/27/stopping-active-directory-attacks-and-other-post-exploitation-behavior-with-amsi-and-machine-learning/) because the user’s pre-authentication data is protected and no longer subject to

265295 offline brute force or dictionary attacks. It also prevents downgrade attacks from spoofed KDCs,

271301 [How Windows Defender Credential Guard works](/windows/security/identity-protection/credential-guard/credential-guard-how-it-works)

272302 article.

273303 1. **Consider requiring SCRIL: Smart Card Required for Interactive Logon** - When deploying SCRIL,

274 − AD changes the user's password to a random 128-bit set which users can no longer use to log on

304 + AD changes the user's password to a random 128-bit set which users can no longer use to sign in

275305 interactively. SCRIL is typically only suitable for environments with

276306 specific security requirements. To learn more about passwordless strategies, review

277307 [Configuring user accounts to disallow password authentication](/windows/security/identity-protection/hello-for-business/passwordless-strategy).

SMB interception defenses

Microsoft's edit · 21 Sep 2022 09:33 UTC