SMB NTLM blocking
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 54be4e4 · +64 −0 lines · also on GitHub
The file is new at this commit, or was moved here from another path: every line shows as added.
1
+---
2
+title: Block NTLM connections on SMB (preview)
3
+description: Learn how to make SMB more secure by blocking NTLM.
4
+ms.topic: article
5
+author: Heidilohr
6
+ms.author: helohr
7
+ms.date: 01/22/2024
8
+ms.prod: windows-server
9
+---
10
+# Block NTLM connections on SMB (preview)
11
+
12
+> [!IMPORTANT]
13
+> NTLM blocking in SMB is currently in PREVIEW.
14
+> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
15
+
16
+The SMB client now supports blocking NTLM queries for remote outbound connections. This new feature prevents bad actors from tricking clients into sending NTLM requests to malicious servers, counteracting brute force, cracking, and pass-the-hash attacks. However, organizations can also enable this layer of protection without having to disable NTLM entirely.
17
+
18
+## Configure NTLM blocking
19
+
20
+To configure NTLM blocking:
21
+
22
+#### [Group Policy](#tab/group-policy)
23
+
24
+1. Open the **Group Policy editor**.
25
+
26
+1. Go to **Computer Configuration** > **Administrative Templates** > **Network** > **Lanman Workstation** > **Block NTLM (LM, NTLM, NTLMv2)**.
27
+
28
+1. Set the policy to **Disabled**.
29
+
30
+#### [PowerShell](#tab/powershell)
31
+
32
+1. Open an elevated PowerShell window.
33
+
34
+1. Run the following command to enable NTLM blocking:
35
+
36
+ ```powershell
37
+ NET USE \\server\share /BLOCKNTLM
38
+ ```
39
+
40
+1. Run this command to specify NTLM blocking when mapping an SMB drive:
41
+
42
+ ```powershell
43
+ New-SmbMapping -RemotePath \\server\share -BlockNTLM $true
44
+ ```
45
+
46
+---
47
+
48
+## Enable exceptions to NTLM blocking
49
+
50
+To enable a list of exceptions to NTLM blocking:
51
+
52
+#### [Group Policy](#tab/group-policy)
53
+
54
+1. Go to **Computer Configuration** > **Administrative Templates** > **Network** > **Lanman Workstation** > **Block NTLM Server Exception List**.
55
+
56
+1. Set the policy to **Enabled**.
57
+
58
+1. Enter the names, NetBIOS names, and fully-qualified domain name (FQDNS) names for the remote machines you want to allow NTLM authentication for.
59
+
60
+#### [PowerShell](#tab/powershell)
61
+
62
+<!--- Content here -->
63
+
64
+---
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:53 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.