SMB interception defenses
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit a5d085b · +3 −3 lines · also on GitHub
⋯ 100 unchanged lines
101101
### Disable guest authentication and fallback
102102
103103
In SMB 1.0 when a user's credentials fail, the SMB client will try guest access. Starting in Windows
104
−10, version 1709, and Windows Server 2019, SMB2 and SMB3 clients no longer allow guess account
104
+10, version 1709, and Windows Server 2019, SMB2 and SMB3 clients no longer allow guest account
105105
access or fallback to the guest account by default. You should use SMB 2.0 or higher and disable
106106
the use of SMB guest access on any systems where guest access isn't disabled by default.
107107
⋯ 3 unchanged lines
111111
112112
When guest access is disabled, it prevents a malicious actor from creating a server and tricking users
113113
into accessing it using guest access. For example, when a user accesses the spoofed share, their
114
−credentials would fail and SMB 1.0 would fall back to using guest access. Disabling guess access
114
+credentials would fail and SMB 1.0 would fall back to using guest access. Disabling guest access
115115
stops the SMB session from connecting, preventing the user from accessing the share and any
116116
malicious files.
117117
⋯ 161 unchanged lines
279279
1. **Deploy Windows Hello for Business or smart cards** - Two-factor authentication with Windows
280280
Hello for Business adds an entire new layer of protection. Learn about
281281
[Windows Hello for Business](/windows/security/identity-protection/hello-for-business/hello-overview).
282
−1. **Enforce long passwords and phrases** - We encourage using longer password lengths such as 14
282
+1. **Enforce long passwords and phrases** - We encourage using longer password lengths such as 15
283283
characters or more to reduce your resistance to brute force attacks. You should also avoid common
284284
words or phrases to make your password even stronger.
285285
1. **Deploy Azure AD Password Protection for Active Directory Domain Services** - Use Azure AD
⋯ 36 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 09:45 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.