SMB security hardening
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit c602124 · +15 −11 lines · also on GitHub
⋯ 3 unchanged lines
44
ms.topic: article
55
author: xelu86
66
ms.author: wscontent
7
−ms.date: 09/25/2024
7
+ms.date: 09/26/2024
88
---
99
1010
# SMB security hardening
⋯ 10 unchanged lines
2121
2222
Understanding SMB security features can help users safeguard their sensitive data and prevent unauthorized access to shared resources. The next section provides a brief overview of these features.
2323
24
+### SMB signing
25
+
26
+Starting with Windows 11 24H2 and Windows Server 2025, all outbound and inbound SMB connections are now required to be signed by default. Previously, SMB signing was only required by default for connections to shares named **SYSVOL** and **NETLOGON**, and for clients of AD domain controllers.
27
+
28
+SMB signing prevents data tampering and relay attacks that steal credentials. By making signing mandatory by default, administrators and users don't need to be experts in SMB network protocol security to enable this important security feature. Enabling SMB signing causes clients and servers to only accept packets that are signed, and reject any that aren't. Packets from guest users are rejected, which means that the feature allowing users to connect to a server without providing credentials (guest fallback) is disabled. This security measure helps prevent unauthorized access and data breaches by requiring users to authenticate themselves before accessing a server, which ensures that only authorized users can access the server and its resources.
29
+
30
+To learn more, see [Control SMB signing behavior](smb-signing.md).
31
+
2432
### SMB alternative ports
2533
26
−The SMB client can be used to establish connections with alternative ports for TCP, QUIC, and RDMA. These ports may differ from the default ports assigned by the Internet Assigned Numbers Authority (IANA) and the Internet Engineering Task Force (IETF), which are 445, 5445, and 443 for TCP, QUIC, and RDMA respectively.
34
+The SMB client can be used to establish connections with alternative ports for TCP, QUIC, and RDMA. These ports may differ from the default ports assigned by the Internet Assigned Numbers Authority (IANA) and the Internet Engineering Task Force (IETF), which are 445, 443, and 5445 for TCP, QUIC, and RDMA respectively.
2735
2836
In Windows Server, it's possible to host an SMB over QUIC connection on a firewall port that is permitted, but not necessarily the default port 443. However, it's important to note that connecting to alternative ports is only possible if the SMB server is configured to listen on that specific port. Additionally, it's possible to configure the deployment to disallow the use of alternative ports or to restrict their usage to certain servers.
2937
⋯ 37 unchanged lines
6775
6876
### SMB Firewall default port changes
6977
70
−The SMB NetBIOS ports are no longer included in the built-in firewall rules. These ports were only required for SMB1 usage, which is now deprecated and removed by default. This modification aligns SMB firewall rules with the standard behavior of the Windows Server File Server role. Administrators are able to reconfigure the rules to restore the legacy ports.
78
+The SMB NetBIOS ports are no longer included in the built-in firewall rules. These ports were only required for SMB1 usage, which is now deprecated and removed by default. This modification aligns SMB firewall rules with the standard behavior of the *Windows Server File Server* role. Administrators are able to reconfigure the rules to restore the legacy ports.
7179
7280
To learn more, see [Updated firewall rules](smb-secure-traffic.md#updated-firewall-rules-preview).
7381
⋯ 7 unchanged lines
8189
8290
### SMB NTLM blocking
8391
84
−The SMB client can now prevent New Technology LAN Manager (NTLM) authentication for remote outbound connections. This modifies the previous behavior of always using negotiated authentication that could downgrade from Kerberos to NTLM. By blocking NTLM authentication, this safeguards client devices against sending NTLM requests to malicious servers, thus mitigating brute force, cracking, relay, and pass-the-hash attacks.
92
+The SMB client can now prevent NTLM authentication for remote outbound connections. This modifies the previous behavior of always using negotiated authentication that could downgrade from Kerberos to NTLM. By blocking NTLM authentication, this safeguards client devices against sending NTLM requests to malicious servers, thus mitigating brute force, cracking, relay, and pass-the-hash attacks.
8593
8694
NTLM blocking is necessary for enforcing an organization's authentication to Kerberos, which is more secure because it verifies identities with its ticket system and superior cryptography. Administrators can specify exceptions to permit NTLM authentication over SMB to specific servers.
8795
⋯ 17 unchanged lines
105113
106114
### SMB over QUIC in Windows Server
107115
108
−SMB over QUIC is now available in all editions of Windows Server 2025 whereas it was only present in the Azure Edition of Windows Server 2022. SMB over QUIC is an alternative to the outdated TCP protocol and is intended for use on untrusted networks such as the Internet. TLS 1.3 and certificates are used to ensure that all SMB traffic is encrypted, enabling it to be utilized through edge firewalls by mobile and remote users without the need for a VPN.
116
+SMB over QUIC is now available in all editions of Windows Server 2025 whereas it was only present in the Azure Edition of Windows Server 2022. SMB over QUIC is an alternative to the outdated TCP protocol and is intended for use on untrusted networks such as the Internet. TLS 1.3 and certificates are used to ensure that all SMB traffic is encrypted, enabling it to be utilized through edge firewalls by mobile and remote users without the need for a VPN. QUIC also ensures that if NTLM is required, a user challenge-response (password data) isn't exposed on the network like it is with TCP.
109117
110118
To learn more, see:
111119
⋯ 11 unchanged lines
123131
124132
- [Features removed or no longer developed starting with Windows Server 2025](/windows-server/get-started/removed-deprecated-features-windows-server-2025)
125133
126
−### SMB signing
127
−
128
−Starting with Windows 11 24H2 and Windows Server 2025, all outbound and inbound SMB connections are now required to be signed by default. Previously, SMB signing was only required by default for connections to shares named **SYSVOL** and **NETLOGON**, and for clients of AD domain controllers.
129
−
130
−SMB signing prevents data tampering and relay attacks that steal credentials. By making signing mandatory by default, administrators and users don't need to be experts in SMB network protocol security to enable this important security feature.
134
+## See also
131135
132
−To learn more, see [Control SMB signing behavior](smb-signing.md).
136
+- [SMB security enhancements](smb-security.md)
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 09:24 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.