SMB NTLM blocking
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit af76fd5 · +2 −2 lines · also on GitHub
⋯ 14 unchanged lines
1515
1616
The SMB client now supports blocking NTLM queries for remote outbound connections. Blocking NTLM queries prevents bad actors from tricking clients into sending NTLM requests to malicious servers, counteracting brute force, cracking, and pass-the-hash attacks. NTLM blocking is also required for switching an organization's authentication protocols to Kerberos, which is more secure than NTLM because it can verify server identities with its ticket system. However, organizations can also enable this layer of protection without having to disable NTLM entirely.
1717
18
−## Configure NTLM blocking
18
+## Configure SMB client NTLM blocking
1919
20
−Windows 11 enables NTLM blocking by default, but earlier versions of Windows don't. To ensure maximum security on deployments running earlier versions of Windows, you must disable NTLM manually, either by editing the relevant Group Policy or running a specific command in PowerShell.
20
+Beginning with Windows Server Preview build 25951 and Windows 11 NTLM blocking is enabled by default. To improved the security of deployments running earlier versions of Windows, you must disable NTLM manually, either by editing the relevant Group Policy or running a specific command in PowerShell.
2121
2222
To configure NTLM blocking:
2323
⋯ 69 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:53 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.