SMB NTLM blocking
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 7d9c0a3 · +8 −2 lines · also on GitHub
⋯ 16 unchanged lines
1717
1818
## Prerequisites
1919
20
−In order to use NTLM blocking for the SMB client, you need the following things:
20
+NTLM blocking for the SMB client requires the following:
2121
2222
- A Windows 11 deployment.
2323
- Windows Server Preview build 25951 or later.
⋯ 47 unchanged lines
7171
There isn't currently a PowerShell equivalent to the Block NTLM Server Exception List Group Policy object. In order to set up an exception list, you must go into the Group Policy Editor and configure the setting manually. However, once you've completed the manual setup, you can make individual exceptions for certain IPs by running this command:
7272
7373
```powershell
74
− Set-SmbServerConfiguration -ExceptionList "<IP Address>"
74
+ $params = @{
75
+ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation"
76
+ Name = "BlockNTLMServerExceptionList"
77
+ }
78
+ $CurrentValue = (Get-ItemProperty @params).BlockNTLMServerExceptionList
79
+ $params["Value"] = if ($CurrentValue -eq $null) { @("") } else { $CurrentValue + "<IP Address>" }
80
+ Set-ItemProperty @params
7581
```
7682
7783
---
⋯ 24 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:53 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.