SMB NTLM blocking
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 94a2b2e · +13 −9 lines · also on GitHub
⋯ 3 unchanged lines
44
ms.topic: how-to
55
author: Heidilohr
66
ms.author: helohr
7
−ms.date: 02/21/2024
8
−ms.prod: windows-server
7
+ms.date: 03/07/2024
98
---
109
# Block NTLM connections on SMB (preview)
1110
⋯ 5 unchanged lines
1716
1817
## Prerequisites
1918
20
−NTLM blocking for the SMB client requires the following:
19
+NTLM blocking for the SMB client requires the following prerequisites:
2120
22
−- A Windows 11 Preview build.
23
−- A server that allows using Kerberos.
21
+- An SMB client running on one of the following operating systems.
22
+ - [Windows Server Insiders build 25951](https://techcommunity.microsoft.com/t5/windows-server-insiders/announcing-windows-server-preview-build-25951/m-p/3926636) or later.
23
+ - [Windows 11 Insiders build 25951](https://blogs.windows.com/windows-insider/2023/09/13/announcing-windows-11-insider-preview-build-25951-canary-channel/) or later.
24
+- An SMB server that allows using Kerberos.
2425
26
+> [!TIP]
27
+> NTLM blocking is an SMB client capability only. The SMB client is built into both Windows Server and Windows client operating systems. The destination SMB server can be any operating system where PKU2U or kerberos can be used.
28
+
2529
## Configure SMB client NTLM blocking
2630
27
−In the Windows 11 preview build, you now have the option to configure SMB to block NTLM. To improve the security of deployments running earlier versions of Windows, you must disable NTLM manually, either by editing the relevant Group Policy or running a specific command in PowerShell.
31
+Starting with Windows Server Insiders build 25951 and Windows 11 Insiders build 25951, you have the option to configure SMB to block NTLM. To improve the security of deployments running earlier versions of Windows, you must disable NTLM manually, either by editing the relevant Group Policy or running a specific command in PowerShell.
2832
2933
To configure NTLM blocking:
3034
⋯ 11 unchanged lines
4246
4347
1. Open an elevated PowerShell window.
4448
45
−1. Run the following command to enable NTLM blocking:
49
+1. Run the following command to enable NTLM blocking.
4650
4751
```powershell
4852
Set-SMbClientConfiguration -BlockNTLM $true
⋯ 3 unchanged lines
5256
5357
## Enable exceptions to NTLM blocking
5458
55
−There may be scenarios where you need to allow certain machines to use NTLM instead of blocking it globally, particularly when the SMB server you're trying to connect to isn't joined to an Active Directory domain.
59
+There might be scenarios where you need to allow certain machines to use NTLM instead of blocking it globally. For example, when the SMB server you're trying to connect to isn't joined to an Active Directory domain.
5660
5761
To enable a list of exceptions to NTLM blocking:
5862
⋯ 9 unchanged lines
6872
6973
#### [PowerShell](#tab/powershell)
7074
71
−There isn't currently a PowerShell equivalent to the Block NTLM Server Exception List Group Policy object. In order to set up an exception list, you must go into the Group Policy Editor and configure the setting manually. However, once you've completed the manual setup, you can make individual exceptions for certain IPs by running this command with the DNS name, IP adress, or NetBIOS name in the `AddToList` parameter:
75
+There isn't currently a PowerShell equivalent to the Block NTLM Server Exception List Group Policy object. In order to set up an exception list, you must go into the Group Policy Editor and configure the setting manually. However, once you've completed the manual setup, you can make individual exceptions for certain IPs by running this command with the DNS name, IP address, or NetBIOS name in the `AddToList` parameter:
7276
7377
```powershell
7478
$params = @{
⋯ 44 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:53 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.