SMB NTLM blocking
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit a85149c · +38 −16 lines · also on GitHub
⋯ 12 unchanged lines
1313
> NTLM blocking in SMB is currently in PREVIEW.
1414
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
1515
16
−The SMB client now supports blocking NTLM queries for remote outbound connections. This new feature prevents bad actors from tricking clients into sending NTLM requests to malicious servers, counteracting brute force, cracking, and pass-the-hash attacks. However, organizations can also enable this layer of protection without having to disable NTLM entirely.
16
+The SMB client now supports blocking NTLM queries for remote outbound connections. Blocking NTLM queries prevents bad actors from tricking clients into sending NTLM requests to malicious servers, counteracting brute force, cracking, and pass-the-hash attacks. NTLM blocking is also required for switching an organization's authentication protocols to Kerberos, which is more secure than NTLM because it can verify server identities with its ticket system. However, organizations can also enable this layer of protection without having to disable NTLM entirely.
1717
1818
## Configure NTLM blocking
1919
20
+Windows 11 enables NTLM blocking by default, but earlier versions of Windows don't. To ensure maximum security on deployments running earlier versions of Windows, you must disable NTLM manually, either by editing the relevant Group Policy or running a specific command in PowerShell.
21
+
2022
To configure NTLM blocking:
2123
2224
#### [Group Policy](#tab/group-policy)
2325
24
−1. Open the **Group Policy editor**.
26
+1. Open the **Group Policy Management Console**.
2527
26
−1. Go to **Computer Configuration** > **Administrative Templates** > **Network** > **Lanman Workstation** > **Block NTLM (LM, NTLM, NTLMv2)**.
28
+1. In the console tree, go to **Computer Configuration** > **Administrative Templates** > **Network** > **Lanman Workstation**.
2729
28
−1. Set the policy to **Disabled**.
30
+1. Right-click **Block NTLM (LM, NTLM, NTLMv2)** and select **Edit**.
2931
32
+1. Select **Disabled**.
33
+
3034
#### [PowerShell](#tab/powershell)
3135
3236
1. Open an elevated PowerShell window.
⋯ 1 unchanged line
3438
1. Run the following command to enable NTLM blocking:
3539
3640
```powershell
37
− NET USE \\server\share /BLOCKNTLM
38
− ```
39
−
40
−1. Run this command to specify NTLM blocking when mapping an SMB drive:
41
−
42
− ```powershell
43
− New-SmbMapping -RemotePath \\server\share -BlockNTLM $true
41
+ Set-SMbClientConfiguration -BlockNTLM $true
4442
```
4543
46
−---
44
+---
4745
4846
## Enable exceptions to NTLM blocking
4947
48
+There may be scenarios where you need to allow certain machines to use NTLM instead of blocking it globally, particularly when running earlier versions of Windows or Windows Server.
49
+
5050
To enable a list of exceptions to NTLM blocking:
5151
5252
#### [Group Policy](#tab/group-policy)
5353
54
−1. Go to **Computer Configuration** > **Administrative Templates** > **Network** > **Lanman Workstation** > **Block NTLM Server Exception List**.
54
+1. In the **Group Policy Editor Console** tree, go to **Computer Configuration** > **Administrative Templates** > **Network** > **Lanman Workstation**.
5555
56
−1. Set the policy to **Enabled**.
56
+1. Right-click **Block NTLM Server Exception List** and select **Edit**.
5757
58
+1. Select **Enabled**.
59
+
5860
1. Enter the names, NetBIOS names, and fully-qualified domain name (FQDNS) names for the remote machines you want to allow NTLM authentication for.
5961
6062
#### [PowerShell](#tab/powershell)
6163
62
−<!--- Content here -->
64
+There isn't currently a PowerShell equivalent to the Block NTLM Server Exception List that lets you block only specific existing remote machines. However, you can block NTLM when mapping new SMB drives by running the following commands.
6365
64
−---
66
+1. Run this command to specify NTLM blocking when mapping a drive with NET USE:
67
+
68
+ ```powershell
69
+ NET USE \\server\share /BLOCKNTLM
70
+ ```
71
+
72
+1. Run this command to specify NTLM blocking when mapping an SMB drive:
73
+
74
+ ```powershell
75
+ New-SmbMapping -RemotePath \\server\share -BlockNTLM $true
76
+ ```
77
+
78
+---
79
+
80
+## Related content
81
+
82
+- [Protect SMB traffic from interception](smb-interception-defense.md)
83
+
84
+- [SMB security](smb-security.md)
85
+
86
+- [Secure SMB traffic in Windows Server](smb-secure-traffic.md)
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:53 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.