SMB NTLM blocking
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 7cb7079 · +13 −2 lines · also on GitHub
⋯ 67 unchanged lines
6868
6969
#### [PowerShell](#tab/powershell)
7070
71
−There isn't currently a PowerShell equivalent to the Block NTLM Server Exception List Group Policy object. In order to set up an exception list, you must go into the Group Policy Editor and configure the setting manually. However, once you've completed the manual setup, you can make individual exceptions for certain IPs by running this command:
71
+There isn't currently a PowerShell equivalent to the Block NTLM Server Exception List Group Policy object. In order to set up an exception list, you must go into the Group Policy Editor and configure the setting manually. However, once you've completed the manual setup, you can make individual exceptions for certain IPs by running this command with the DNS name, IP adress, or NetBIOS name in the `AddToList` parameter:
7272
7373
```powershell
7474
$params = @{
⋯ 1 unchanged line
7676
Name = "BlockNTLMServerExceptionList"
7777
}
7878
$CurrentValue = (Get-ItemProperty @params).BlockNTLMServerExceptionList
79
− $params["Value"] = if ($CurrentValue -eq $null) { @("") } else { $CurrentValue + "<IP Address>" }
79
+ $params["Value"] = if ($CurrentValue -eq $null) { @("") } else { $CurrentValue + "AddToList" }
8080
Set-ItemProperty @params
8181
```
8282
83
+ You can also add multiple variables to the `AddToList` parameter by separating them with a comma, as shown in the following example command:
84
+
85
+ ```powershell
86
+ $params = @{
87
+ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation"
88
+ Name = "BlockNTLMServerExceptionList"
89
+ }
90
+ $CurrentValue = (Get-ItemProperty @params).BlockNTLMServerExceptionList
91
+ $params["Value"] = if ($CurrentValue -eq $null) { @("") } else { $CurrentValue + "192.168.10.10","corp.contoso.com","CORP" }
92
+ Set-ItemProperty @params
93
+ ```
8394
---
8495
8596
## Block NTLM while mapping SMB drives
⋯ 22 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:53 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.