Microsoft's edit · SMB interception defenses

1 +---

2 +title: Protect SMB traffic from interception

3 +description: How to configure Windows Server to harden SMB protocol to defend against interception attacks.

4 +ms.topic: conceptual

5 +author: robinharwood

6 +ms.author: roharwoo

7 +ms.date: 08/10/2022

8 +# Customer Intent: As a system or security administrator, I want to prevent SMB interception

9 +# attacks, so that I can mitigate security risks within my environment

10 +---

11 +

12 +# Protect SMB traffic from interception

13 +

14 +In this article, you'll learn about some of the ways an attacker might use interception techniques

15 +against the SMB protocol and how you might mitigate an attack. The concepts will support you with

16 +developing your own defense-in-depth strategy for the SMB protocol.

17 +

18 +## What is an interception attack?

19 +

20 +An adversary-in-the-middle (AITM) attack intends to modify the network communication between a

21 +client and server, allowing a threat actor to intercept traffic, this is known as interception.

22 +After interception, a malicious actor may have the ability to spoof, tamper, disclose, or deny

23 +access to your organizations data or account credentials.

24 +

25 +Many organizations rely on SMB to share files between users and to support other applications or

26 +technologies like Active Directory Domain Services. With such broad adoption, SMB is both a popular

27 +target for attackers and has the potential for business-wide impact.

28 +

29 +For example, an intercept attack might be for industrial or state-level espionage, extortion, or

30 +finding sensitive security data stored in files. It could also be used as part of a wider attack to

31 +enable the attacker to move laterally within your network or to target multiple endpoints.

32 +

33 +Attacks are constantly evolving, with attackers often using a combination of established and new

34 +techniques. When protecting your system against SMB interception, there are two main goals:

35 +

36 +1. Reduce the number of attack methods available.

37 +1. Secure the pathways you present to your users.

38 +

39 +Due to the diversity of technology and clients within many organizations, a well-rounded defense will

40 +combine multiple methods and will follow the [Zero Trust](/security/zero-trust/zero-trust-overview)

41 +principles.

42 +

43 +Now you'll learn about some of the typical good practice configurations to reduce the risk of SMB

44 +interception.

45 +

46 +## Reducing the attack methods available

47 +

48 +To protect your system against SMB interception attacks, your first step should be to reduce the

49 +attack surface. Attack surfaces are places where your system is vulnerable to cyberthreats and

50 +compromise.

51 +

52 +In the following sections, we'll discuss some of the basic steps you should take to reduce the

53 +attack surface.

54 +

55 +### Install updates

56 +

57 +Regularly install all available security updates on both your Windows Server and client systems as

58 +close to their release as your organization allows. Installing the latest security updates is the

59 +quickest and easiest way to protect your systems from the current known security vulnerabilities

60 +affecting not just SMB, but all Microsoft products and services.

61 +

62 +You can install security updates using a few different methods depending on your organizations

63 +requirements. Typical methods are:

64 +

65 +- [Windows Update](https://support.microsoft.com/windows/get-the-latest-windows-update-7d20e88c-0568-483a-37bc-c3885390d212#WindowsVersion=Windows_11)

66 +- [Windows Server Update Services (WSUS)](../../administration/windows-server-update-services/get-started/windows-server-update-services-wsus.md)

67 +- [Software updates in Endpoint Configuration Manager](/mem/configmgr/sum/understand/software-updates-introduction)

68 +- [Azure Update Management](/azure/automation/update-management/overview)

69 +

70 +Consider subscribing to notifications in the

71 +[Microsoft Security Response Center (MSRC) Security Update Guide](https://msrc.microsoft.com/update-guide/).

72 +The _Security Update Guide Notification System_ will let you know when software updates are

73 +published to address new and existing Common Vulnerabilities and Exposures (CVEs).

74 +

75 +### Remove SMB 1.0

76 +

77 +You should remove or disable the SMB 1.0 feature from all Windows Servers and clients that don't

78 +require it. For systems that do require SMB 1.0, you should move to SMB 2.0 or higher as soon as

79 +possible. Starting in the Windows 10 Fall Creators Update and Windows Server 2019, [SMB 1.0 is no

80 +longer installed by default](Troubleshoot/smbv1-not-installed-by-default-in-windows.md).

81 +

82 +Removing SMB 1.0 protects your systems by eliminating several well known security vulnerabilities.

83 +SMB 1.0 lacks the security features of SMB 2.0 and later that help protect against interception. For

84 +example, to prevent a compromised connection SMB 3.0 or later uses pre-authentication integrity,

85 +encryption, and signing. Learn more in the [SMB security enhancements](smb-security.md) article.

86 +

87 +Before removing the SMB 1.0 feature, be sure no applications and processes on the computer require

88 +it. For more information on how to detect and disable SMB 1.0, see the article

89 +[How to detect, enable and disable SMBv1, SMBv2, and SMBv3 in Windows](Troubleshoot/detect-enable-and-disable-smbv1-v2-v3.md#how-to-remove-smbv1).

90 +

91 +You can also use the Windows Admin Center

92 +[Files and file sharing tool](../../manage/windows-admin-center/use/manage-servers.md) to both

93 +quickly enable the auditing of SMB1 client connections and to uninstall SMB 1.

94 +

95 +### Disable guest authentication and fallback

96 +

97 +In SMB 1.0 when a user's credentials fail, the SMB client will try guest access. Starting in Windows

98 +10, version 1709, and Windows Server 2019, SMB2 and SMB3 clients no longer allow guess account

99 +access or fallback to the guest account by default. You should use SMB 2.0 or higher and disable

100 +the use of SMB guest access on any systems where guest access isn't disabled by default.

101 +

102 +When guest access is disabled, it prevents a malicious actor from creating a server and tricking users

103 +into accessing it using guest access. For example, when a user accesses the spoofed share, their

104 +credentials would fail and SMB 1.0 would fallback to using guest access. Disabling guess access

105 +stops the SMB session from connecting, preventing the user from accessing the share and any

106 +malicious files.

107 +

108 +To prevent the use of guest fallback on Windows SMB clients where guest access isn't disabled by

109 +default (including Windows Server), you configure the following group policy:

110 +

111 +1. Open the **Group Policy Management Console**.

112 +1. In the console tree, select **Computer Configuration > Administrative Templates > Network >

113 + Lanman Workstation**.

114 +1. For the setting, right-click **Enable insecure guest logons** and select **Edit**.

115 +1. Select **Enabled** and select **OK**.

116 +

117 +To learn more about guest access default behavior, read the article

118 +[Guest access in SMB2 and SMB3 disabled by default in Windows](/troubleshoot/windows-server/networking/guest-access-in-smb2-is-disabled-by-default).

119 +

120 +### Disable the WebDAV protocol

121 +

122 +Windows clients may not require the `WebClient` service to be running. The service

123 +provides the Web Distributed Authoring and Versioning (WebDAV) protocol. If your clients aren't

124 +accessing SMB shares over HTTP or HTTPS using WebDAV, you can disable the service.

125 +

126 +When your users are accessing files using WebDAV, there's no method to force a TLS based connection

127 +over HTTPS. For example, your server may be configured to require SMB signing or encryption, however

128 +the Webclient could connect to HTTP/80 if WebDAV has been enabled. Any resulting connection would be

129 +unencrypted, regardless of your SMB configuration.

130 +

131 +You can use Group Policy Preferences to disable the service on a large number of machines when you're ready to implement. For more information about configuring Group Policy Preferences, see

132 +[Configure a Service Item](/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/cc732482(v=ws.10)).

133 +

134 +### Restrict outbound SMB destinations

135 +

136 +Block outbound SMB traffic to devices outside your network as a minimum. Blocking outbound SMB

137 +prevents data being sent to external endpoints. Malicious actors often try spoofing, tampering or

138 +phishing attacks that attempt to send users to malicious endpoints disguised as friendly links or

139 +shortcuts within emails or other files. To learn more about blocking outbound SMB access, read the

140 +[Secure SMB Traffic in Windows Server](smb-secure-traffic.md#block-outbound-smb-access) article.

141 +

142 +Take this principle further by introducing micro-perimeters and micro-segmentation into your

143 +architecture. Blocking outbound SMB traffic to external networks helps to prevent the direct

144 +exfiltration of data to internet, however modern attacks use advanced techniques to indirectly gain

145 +access by attacking other systems, then moving laterally within your network. Micro-perimeters and

146 +micro-segmentation aim to reduce the number of systems and users being able to directly connect to

147 +your SMB share unless that explicitly need to. Learn more about

148 +[Network segmentation](/security/zero-trust/deploy/networks) as part of our

149 +[Zero Trust Guidance](/security/zero-trust/).

150 +

151 +## Secure the protocol

152 +

153 +Your second goal is to secure the pathways between your users and their data, known as

154 +data-in-transit protection. Data-in-transit protection typically involves the use of encryption,

155 +interface hardening, and removing insecure protocols to improve your resistance to attack.

156 +

157 +In the following sections, we'll discuss some of the basic steps you should take to secure the SMB

158 +protocol.

159 +

160 +### Use SMB 3.1.1

161 +

162 +Windows always negotiates to the highest available protocol, ensure your devices and machines

163 +support SMB 3.1.1.

164 +

165 +SMB 3.1.1 is available beginning with Windows 10 and Windows Server 2016. SMB 3.1.1 includes a new

166 +mandatory security feature called _pre-authentication integrity_. Pre-authentication integrity signs

167 +or encrypts the early phases of SMB connections to prevent the tampering of Negotiate and Session

168 +Setup messages by using cryptographic hashing.

169 +

170 +Using cryptographic hashing, the client and server can mutually trust the connection and session

171 +properties. Pre-authentication integrity supersedes _secure dialect negotiation_ introduced in SMB

172 +3.0. You can’t turn off pre-authentication integrity, but if a client uses an older dialect, it

173 +won’t be used.

174 +

175 +You can enhance your security posture further by forcing the use of SMB 3.1.1 as a minimum. To set

176 +the minimum SMB dialect to 3.1.1, you must create registry DWORD values for `MinSMB2Dialect` and

177 +`MaxSMB2Dialect` with `0x000000311` as the value data. The registry values are found in the key `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters`.

178 +

179 +To learn more about how to set the minimum SMB dialect used, see

180 +[Controlling SMB dialects](https://techcommunity.microsoft.com/t5/storage-at-microsoft/controlling-smb-dialects/ba-p/860024?WT.mc_id=ITOPSTALK-blog-abartolo).

181 +

182 +### Use UNC hardening to require signing, encryption, and mutual authentication

183 +

184 +Enable UNC hardening for all SMB shares by requiring at least mutual authentication (Kerberos) and

185 +integrity (SMB signing). You should also consider evaluating privacy (SMB encryption) instead of SMB

186 +signing. There's no need to configure both SMB signing and encryption because encryption implicitly

187 +includes the signatures used by signing.

188 +

189 +> [!CAUTION]

190 +> SMB encryption was introduced with SMB 3 in Windows 8 and Windows Server 2012. You shouldn't

191 +> require encryption unless all your machines support SMB 3.0 or later, or are third parties with

192 +> SMB 3 and encryption support. If you configure SMB encryption on clients or UNC paths hosted by

193 +> servers that do not support SMB Encryption, the SMB client will be unable to access the specified

194 +> path.

195 +

196 +UNC Hardening gives the ability to check UNC paths for mandated security settings and will refuse

197 +to connect if a server couldn't meet them. It's a highly effective tool against spoofing and

198 +tampering because the client can authenticate the identity of the server and validate the

199 +integrity of the SMB payloads.

200 +

201 +When configuring UNC hardening, you can specify various UNC path patterns. For example:

202 +

203 +- `\\<Server>\<Share>` - The configuration entry applies to the share that has the specified name on

204 + the specified server.

205 +- `\\*\<Share>` - The configuration entry applies to the share that has the specified name on any server.

206 +- `\\<Server>\*` - The configuration entry applies to any share on the specified server.

207 +

208 +You can use Group Policy to apply the UNC Hardened Access feature to a large number of machines when you're ready to implement it. For more information about configuring UNC Hardened Access through Group Policy, see the support article

209 +[KB3000483](https://support.microsoft.com/help/3000483/ms15-011-vulnerability-in-group-policy-could-allow-remote-code-executi?WT.mc_id=ITOPSTALK-blog-abartolo).

210 +

211 +### Map drives on demand with mandated signing or encryption

212 +

213 +In addition to UNC Hardened Access, you can use signing or encryption when mapping network drives.

214 +Beginning in Windows version 1709 and later, you can create encrypted or signed mapped drives on

215 +demand using Windows PowerShell or Command Prompt. You can use the `NET USE` command or the

216 +PowerShell `New-SmbMapping` command to map drives by specifying **RequireIntegrity** (signing) or

217 +**RequirePrivacy** (encryption) parameters.

218 +

219 +The commands can be used by administrators or included in scripts to automate the mapping of drives

220 +that require encryption or integrity checks.

221 +

222 +The parameters don't change how signing or encryption work, or the dialect requirements. If you try

223 +to map a drive and the server refuses to honor your requirement for signing or encryption, the drive

224 +mapping will fail rather than connect unsafely.

225 +

226 +Learn about the syntax and parameters for the `New-SmbMapping` command in [New-SmbMapping](/powershell/module/smbshare/new-smbmapping) reference article.

227 +

228 +### Beyond SMB

229 +

230 +Stop using NTLM and increase your Kerberos security. You can start by enabling auditing for NTLM

231 +usage, then reviewing the logs to find where NTLM is used.

232 +

233 +Removing NTLM helps to protect you against common attacks like pass-the-hash, brute-force or rainbow

234 +hash tables due to its use of older MD4/MD5 cryptography hash function. NTLM also isn't able to

235 +verify the server identity, unlike more recent protocols like Kerberos, making it vulnerable to

236 +NTLM relay attacks as well. Many of these attacks are well proven but are also mitigated with

237 +Kerberos.

238 +

239 +To learn how to audit NTLM as part of

240 +your effort to begin the transition to Kerberos, see the

241 +[Assessing NTLM usage](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/jj865670(v%3dws.10)?WT.mc_id=ITOPSTALK-blog-abartolo)

242 +article. You can also read learn about detecting insecure protocols using Azure Sentinel in the [Azure Sentinel Insecure Protocols Workbook Implementation Guide](https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/azure-sentinel-insecure-protocols-workbook-implementation-guide/ba-p/1197564?WT.mc_id=ITOPSTALK-blog-abartolo) blog article.

243 +

244 +In parallel to removing NTLM, you should consider adding more layers of protection for offline

245 +and ticket passing attacks. Use the following items as a guide when enhancing Kerberos security.

246 +

247 +1. **Enforce long passwords and phrases** - 15 characters or more without dictionary words makes

248 + offline brute force extremely time consuming. Avoiding dictionary attacks with pass phrases makes

249 + that even stronger.

250 +1. **Deploy Azure AD Password Protection for Active Directory Domain Services** - Use Azure AD

251 + Password Protect to block known weak passwords and terms that are specific to your organization.

252 + To learn more, review

253 + [Enforce on-premises Azure AD Password Protection for Active Directory Domain Services](/azure/active-directory/authentication/concept-password-ban-bad-on-premises).

254 +1. **Use group Managed Service Accounts (gMSA)** - gMSA enabled services with their 127 random

255 + character construction, makes brute force and dictionary attacks to crack passwords incredibly

256 + time consuming. Read about what gMSAs are in the article

257 + [Group Managed Service Accounts Overview](../../security/group-managed-service-accounts/group-managed-service-accounts-overview.md).

258 +1. **Deploy Windows Hello for Business or smart cards** - Two-factor authentication with Windows

259 + Hello for Business adds an entire new layer of protection. Learn about

260 + [Windows Hello for Business](/windows/security/identity-protection/hello-for-business/hello-overview).

261 + TODO: as well as switching to Public Key Cryptography for Initial Authentication (PKINIT) in the

262 + Kerberos protocol instead of just using passwords.

263 +1. **Kerberos Armoring, known as Flexible Authentication Secure Tunneling (FAST)** - FAST prevents

264 + [Kerberoasting](https://www.microsoft.com/security/blog/2020/08/27/stopping-active-directory-attacks-and-other-post-exploitation-behavior-with-amsi-and-machine-learning/) because the user’s pre-authentication data is protected and no longer subject to

265 + offline brute force or dictionary attacks. It also prevents downgrade attacks from spoofed KDCs,

266 + to learn more review

267 + [Kerberos Armoring](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831747(v=ws.11)).

268 +1. **Use Windows Defender Credential Guard** - Credential Guard makes the local compromise of

269 + tickets harder by preventing ticket-granting and cached service tickets from being stolen. Learn

270 + more in the

271 + [How Windows Defender Credential Guard works](/windows/security/identity-protection/credential-guard/credential-guard-how-it-works)

272 + article.

273 +1. **Consider requiring SCRIL: Smart Card Required for Interactive Logon** - When deploying SCRIL,

274 + AD changes the user's password to a random 128-bit set which users can no longer use to log on

275 + interactively. SCRIL is typically only suitable for environments with

276 + specific security requirements. To learn more about passwordless strategies, review

277 + [Configuring user accounts to disallow password authentication](/windows/security/identity-protection/hello-for-business/passwordless-strategy).

278 +

279 +## Next steps

280 +

281 +Now you've learned about some of the security controls and mitigations to prevent SMB interception, you'll understand there’s no single step to prevent all interception attacks. The goal is to create a

282 +thoughtful, holistic, and prioritized combination of risk mitigations spanning multiple technologies

283 +through layered defenses.

284 +

285 +You can continue to learn more about these concepts in the articles below.

286 +

287 +- [Secure SMB traffic in Windows Server](smb-secure-traffic.md).

288 +- [SMB security enhancements](smb-security.md)

289 +- [SMB 3.1.1 Pre-authentication integrity in Windows 10](/archive/blogs/openspecification/smb-3-1-1-pre-authentication-integrity-in-windows-10?WT.mc_id=ITOPSTALK-blog-abartolo)

290 +- [SMB 2 and SMB 3 security in Windows 10: the anatomy of signing and cryptographic keys](/archive/blogs/openspecification/smb-2-and-smb-3-security-in-windows-10-the-anatomy-of-signing-and-cryptographic-keys?WT.mc_id=ITOPSTALK-blog-abartolo)

291 +- [Zero Trust Guidance Center](/security/zero-trust/)

SMB interception defenses

Microsoft's edit · 21 Sep 2022 09:33 UTC