SMB NTLM blocking
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 691a618 · +7 −7 lines · also on GitHub
⋯ 12 unchanged lines
1313
> Windows Server Insider builds are in PREVIEW.
1414
> This information relates to a prerelease product that may be substantially modified before it's released. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.
1515
16
−The SMB client now supports blocking NTLM queries for remote outbound connections. Blocking NTLM queries prevents bad actors from tricking clients into sending NTLM requests to malicious servers, counteracting brute force, cracking, and pass-the-hash attacks. NTLM blocking is also required for switching an organization's authentication protocols to Kerberos, which is more secure than NTLM because it can verify server identities with its ticket system. However, organizations can also enable this layer of protection without having to disable NTLM entirely.
16
+The SMB client now supports blocking NTLM authentication for remote outbound connections. Blocking NTLM authentication prevents bad actors from tricking clients into sending NTLM requests to malicious servers, counteracting brute force, cracking, and pass-the-hash attacks. NTLM blocking is also required for switching an organization's authentication protocols to Kerberos, which is more secure than NTLM because it can verify server identities with its ticket system. However, organizations can also enable this layer of protection without having to disable NTLM entirely.
1717
1818
## Prerequisites
1919
2020
NTLM blocking for the SMB client requires the following:
2121
22
−- A Windows 11 deployment.
23
−- Windows Server Preview build 25951 or later.
22
+- A Windows 11 Preview build.
23
+- A server that allows using Kerberos.
2424
2525
## Configure SMB client NTLM blocking
2626
27
−Starting with Windows Server Preview build 25951 and Windows 11, the SMB client blocks NTLM by default. To improve the security of deployments running earlier versions of Windows, you must disable NTLM manually, either by editing the relevant Group Policy or running a specific command in PowerShell.
27
+In the Windows 11 preview build, you now have the option to configure SMB to block NTLM. To improve the security of deployments running earlier versions of Windows, you must disable NTLM manually, either by editing the relevant Group Policy or running a specific command in PowerShell.
2828
2929
To configure NTLM blocking:
3030
⋯ 5 unchanged lines
3636
3737
1. Right-click **Block NTLM (LM, NTLM, NTLMv2)** and select **Edit**.
3838
39
−1. Select **Disabled**.
39
+1. Select **Enabled**.
4040
4141
#### [PowerShell](#tab/powershell)
4242
⋯ 9 unchanged lines
5252
5353
## Enable exceptions to NTLM blocking
5454
55
−There may be scenarios where you need to allow certain machines to use NTLM instead of blocking it globally, particularly when running earlier versions of Windows or Windows Server.
55
+There may be scenarios where you need to allow certain machines to use NTLM instead of blocking it globally, particularly when the SMB server you're trying to connect to isn't joined to an Active Directory domain.
5656
5757
To enable a list of exceptions to NTLM blocking:
5858
⋯ 5 unchanged lines
6464
6565
1. Select **Enabled**.
6666
67
−1. Enter the names, NetBIOS names, and fully-qualified domain name (FQDNS) names for the remote machines you want to allow NTLM authentication for.
67
+1. Enter the IP addresses, NetBIOS names, and fully qualified domain names (FQDNs) of the remote machines you want to allow NTLM authentication to.
6868
6969
#### [PowerShell](#tab/powershell)
7070
⋯ 48 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:53 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.