SMB NTLM blocking
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit eaab2fb · +5 −9 lines · also on GitHub
11
---
2
−title: Block NTLM connections on SMB in Windows Server 2025 (preview)
2
+title: Block NTLM connections on SMB in Windows Server 2025
33
description: Learn how to make SMB more secure by blocking NTLM.
44
ms.topic: how-to
55
author: Heidilohr
66
ms.author: helohr
7
−ms.date: 03/07/2024
7
+ms.date: 10/25/2024
88
---
9
−# Block NTLM connections on SMB (preview)
10
−
11
−> [!IMPORTANT]
12
−> Windows Server 2025 is in PREVIEW.
13
−> This information relates to a prerelease product that may be substantially modified before it's released. Microsoft makes no warranties, expressed or implied, with respect to the information provided here.
9
+# Block NTLM connections on SMB
1410
1511
The SMB client now supports blocking NTLM authentication for remote outbound connections. Blocking NTLM authentication prevents bad actors from tricking clients into sending NTLM requests to malicious servers, counteracting brute force, cracking, and pass-the-hash attacks. NTLM blocking is also required for switching an organization's authentication protocols to Kerberos, which is more secure than NTLM because it can verify server identities with its ticket system. However, organizations can also enable this layer of protection without having to disable NTLM entirely.
1612
⋯ 3 unchanged lines
2016
2117
- An SMB client running on one of the following operating systems.
2218
- Windows Server 2025 or later.
23
− - [Windows 11 Insiders build 25951](https://blogs.windows.com/windows-insider/2023/09/13/announcing-windows-11-insider-preview-build-25951-canary-channel/) or later.
19
+ - Windows 11, version 24H2 or later.
2420
- An SMB server that allows using Kerberos.
2521
2622
> [!TIP]
⋯ 1 unchanged line
2824
2925
## Configure SMB client NTLM blocking
3026
31
−Starting with Windows Server 2025 and Windows 11 Insiders build 25951, you have the option to configure SMB to block NTLM. To improve the security of deployments running earlier versions of Windows, you must disable NTLM manually, either by editing the relevant Group Policy or running a specific command in PowerShell.
27
+Starting with Windows Server 2025 and Windows 11, version 24H2, you have the option to configure SMB to block NTLM. To improve the security of deployments running earlier versions of Windows, you must disable NTLM manually, either by editing the relevant Group Policy or running a specific command in PowerShell.
3228
3329
To configure NTLM blocking:
3430
⋯ 88 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 08:53 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.