SMB NTLM blocking
Observed content change
9 removed passages (about 80 words). The changed wording mentions dates and deadlines, prerequisites. Review the source to confirm the effect.
May need admin actionCheck whether new requirements apply to your setup; check the dates against your plans.
[removed: Note]
[removed: Access to this page requires authorization. You can try signing in or changing directories.]
[removed: Access to this page requires authorization. You can try changing directories.]
[removed: Applies to: ✅ Windows Server 2025, ✅ Windows Server 2022, ✅ Windows Server 2019, ✅ Windows Server 2016, ✅ Windows 11, ✅ Windows 10, ✅ Azure Local 2311.2 and later]
[removed: Was this page helpful?]
[removed: Need help with this topic?]
[removed: Want to try using Ask Learn to clarify or guide you through this topic?]
Microsoft's wording from Microsoft source, © Microsoft Corporation, under CC BY 4.0. ChangeIntel marks removed and added words, drops formatting and shortens long unchanged stretches.
Read the current Microsoft source · Link to this observation · Compare any two versions
Sections to inspect
- Block NTLM connections on SMB
- Feedback
- Additional resources
Up to 12 section headings from retained before/after evidence. The current source may have changed again.
Why this was flagged
The changed words, with a few words around them, matched these rule categories: dates and deadlines, prerequisites. These matches identify subjects to assess; they do not establish a policy change or applicability.
Observation details · observed 13 Oct 00:55 UTC
- Observed by ChangeIntel
- 13 Oct 00:55 UTC
- Source update metadata
- 6 Jan 18:40 UTC
- First observed on this installation
- 5 Oct 23:18 UTC
- Last successful check
- today 00:44 UTC
- Next check due
- 21 Oct 00:44 UTC
Observation time is not publication time, and a comparison does not establish an effective date. Full source bodies are not published; this page holds generated summaries, section headings and, as the page's license allows, Microsoft's changed wording. A documentation edit does not confirm feature availability in an environment.
Watch this page to review its changes in My radar.
Timeline
From the capture of 13 Oct 00:55 UTC- 4 undated sections
- 2 with conditions
- 31 recorded changes
Settings and overrides named on this page
Registry values, policies and cmdlets the source mentions, with the dated steps that name them. Read the source for the values to set.
AddToListOverride
Requirements, exceptions and scope
The SMB client now supports blocking NTLM authentication for remote outbound connections. Blocking NTLM authentication prevents bad actors from tricking clients into sending NTLM requests…
AddToList
Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.
How this timeline changed
Changes between ChangeIntel's readings of the page, between commits of its source file where Microsoft publishes it, in Internet Archive copies of pages that keep no other history, and entries from Microsoft's own change log (dated as Microsoft dates them). Edits between readings that neither records are unknown.
19 earlier changes
Observed history and review priority
Captured 13 Oct 00:55 UTC; extracted 16 Oct 16:10 UTC. Extractor: microsoft-1/9/fc65ebeb286710c0a830833db8a7e5de7e266b79981fe9c7c34479be9369ad3c.
Review priority. Extracted assertions require review · Applicability or exceptions require review
0 date changes and 0 condition changes across 0 compared revisions. Suggested check interval: 24 hours.
Earlier unavailable versions and edits between checks are unknown. A missing statement requires review; it does not mean the policy was cancelled. Recovered historical statements are not original revision snapshots.
Retained observations · 19
Compact evidence remains available after full document bodies expire. Earlier extractions can have different vocabulary or capture limitations.
- 13 Oct 00:55 UTC · 5 candidates
- 5 Oct 23:18 UTC · 8 candidates
- 6 Jan 09:36 UTC · 5 candidates
- 23 Jul 2025 11:25 UTC · 5 candidates
- 25 Oct 2024 17:01 UTC · 5 candidates
- 18 Sep 2024 15:22 UTC · 5 candidates
- 6 Sep 2024 15:00 UTC · 5 candidates
- 13 Aug 2024 19:27 UTC · 5 candidates
- 7 Mar 2024 13:13 UTC · 5 candidates
- 4 Mar 2024 23:10 UTC · 4 candidates
- 21 Feb 2024 16:27 UTC · 4 candidates
- 20 Feb 2024 23:45 UTC · 4 candidates
- 2 Feb 2024 18:56 UTC · 4 candidates
- 30 Jan 2024 18:21 UTC · 3 candidates
- 30 Jan 2024 17:46 UTC · 3 candidates
- 30 Jan 2024 17:12 UTC · 3 candidates
- 29 Jan 2024 22:56 UTC · 3 candidates
- 24 Jan 2024 00:42 UTC · 4 candidates
- 23 Jan 2024 00:59 UTC · 0 candidates
Microsoft's edits
History on GitHubCommits to the page's source in MicrosoftDocs/windowsserverdocs, with Microsoft's own messages. Commit dates can be hours or days before Learn publishes the change. ChangeIntel keeps a copy of each diff, so an edit stays readable here if GitHub stops serving it. Read 19 Oct 23:56 UTC.
Related public evidence
- Public source · 13 Oct 2026Active Directory Federation Services (AD FS) Spoofing Vulnerability
- Public source · 13 Oct 2026Active Directory Federation Services (AD FS) Spoofing Vulnerability
- Public source · 13 Oct 2026Windows Kerberos Elevation of Privilege Vulnerability
- Public source · 13 Oct 2026Active Directory Federation Services (AD FS) Security Feature Bypass Vulnerability
- Public source · 13 Oct 2026Active Directory Federation Services (AD FS) Security Feature Bypass Vulnerability
- Public source · 13 Oct 2026Windows Kerberos Elevation of Privilege Vulnerability
Retained observations
- 13 Oct 00:55 UTC · shown above
- 5 Oct 23:18 UTC
Baseline for retained history; no earlier retained text to compare.
What changed
First observed 18 Oct 2026No field changes in the recorded history.
Cite this recorded revision to keep the same title, summary, facts and links when the page changes.
A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.