SMB security hardening
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit e0e7d68 · +132 −0 lines · also on GitHub
The file is new at this commit, or was moved here from another path: every line shows as added.
1
+---
2
+title: SMB security hardening
3
+description: Learn about SMB security enhancements that help harden your Windows Server 2025 environment and Windows 11 client devices.
4
+ms.topic: article
5
+author: robinharwood
6
+ms.author: wscontent
7
+ms.date: 09/25/2024
8
+---
9
+
10
+# SMB security hardening
11
+
12
+The latest SMB (Server Message Block) features introduced in Windows 11 24H2 and Windows Server 2025 are designed to enhance the security of your data, users, and organization. Most of these features are automatically enabled by default. These SMB features aim to provide a safer and more secure computing environment by reducing the risk of cyber attacks and data breaches in your environment.
13
+
14
+Users can download the following versions to preview the security features before our major Operating System (OS) release:
15
+
16
+- [Windows 11 Insider Preview](https://www.microsoft.com/software-download/windowsinsiderpreviewiso)
17
+
18
+- [Windows Server 2025 Evaluation Preview](https://www.microsoft.com/evalcenter/download-windows-server-2025)
19
+
20
+## SMB security features
21
+
22
+Understanding SMB security features can help users safeguard their sensitive data and prevent unauthorized access to shared resources. The next section provides a brief overview of these features.
23
+
24
+### SMB alternative ports
25
+
26
+The SMB client can be used to establish connections with alternative ports for TCP, QUIC, and RDMA. These ports may differ from the default ports assigned by the Internet Assigned Numbers Authority (IANA) and the Internet Engineering Task Force (IETF), which are 445, 5445, and 443 for TCP, QUIC, and RDMA respectively.
27
+
28
+In Windows Server, it's possible to host an SMB over QUIC connection on a firewall port that is permitted, but not necessarily the default port 443. However, it's important to note that connecting to alternative ports is only possible if the SMB server is configured to listen on that specific port. Additionally, it's possible to configure the deployment to disallow the use of alternative ports or to restrict their usage to certain servers.
29
+
30
+To learn more, see [Configure alternative SMB ports](smb-ports.md).
31
+
32
+### SMB auditing improvements
33
+
34
+SMB now has the ability to audit the use of SMB over QUIC, and supports third-party encryption and signing. These features can be utilized at both the SMB server and client level. If you're using Windows or Windows Server devices, it's now simpler to determine whether they're using SMB over QUIC. You can also more easily verify whether third-party software supports signing and encryption before making them mandatory.
35
+
36
+To learn more, see:
37
+
38
+- [SMB over QUIC client auditing](smb-over-quic.md#smb-over-quic-client-auditing)
39
+
40
+- [SMB signing and encryption auditing](smb-signing-overview.md#smb-signing-and-encryption-auditing)
41
+
42
+### SMB authentication rate limiter
43
+
44
+The SMB server service now limits the number of failed authentication attempts. This is applicable to SMB file sharing on both Windows Server and Windows Client. Brute force attacks attempt to guess usernames and passwords, and can bombard the SMB server with dozens to thousands of attempts per second. The SMB authentication rate limiter is now enabled by default, with a 2-second delay between each failed NTLM or Local KDC Kerberos-based authentication attempt. As a result, an attack that sends 300 guesses per second for 5 minutes (90,000 attempts) would now take 50 hours to complete. This makes it much less likely that an attacker persists with this method.
45
+
46
+To learn more, see:
47
+
48
+- [Configure SMB authentication rate limiter for Windows](configure-smb-authentication-rate-limiter.md)
49
+
50
+- [SMB authentication rate limiter demo video](https://www.youtube.com/watch?v=BPC3plpGt40&t=8m17s)
51
+
52
+### SMB client encryption mandate now supported
53
+
54
+The SMB client can now mandate encryption for all outbound SMB connections. This measure ensures the highest level of network security and brings SMB signing to the same level of management. Once enabled, the SMB client only connects to an SMB server that supports SMB 3.0 or later and SMB encryption. It's possible for a third-party SMB server to support SMB 3.0 but not SMB encryption. Unlike SMB signing, encryption isn't mandatory by default.
55
+
56
+To learn more, see [Configure the SMB client to require encryption in Windows](configure-smb-client-require-encryption.md).
57
+
58
+### SMB dialect management
59
+
60
+It's now possible to enforce the use of SMB 2 and 3 protocol versions. Previously, the SMB server and client only supported automatic negotiation of the highest matched dialect from SMB 2.0.2 to 3.1.1. With this new feature, you can intentionally prevent older protocol versions or devices from connecting. For instance, you can specify that connections only use SMB 3.1.1, the most secure dialect of the protocol. The minimum and maximum can be set independently on both the SMB client and server, and you can choose to set only a minimum if desired.
61
+
62
+To learn more, see:
63
+
64
+- [Manage SMB dialects in Windows and Windows Server 2025](manage-smb-dialects.md)
65
+
66
+- [SMB dialect control demo video](https://www.youtube.com/watch?v=BPC3plpGt40&t=32m14s)
67
+
68
+### SMB Firewall default port changes
69
+
70
+The SMB NetBIOS ports are no longer included in the built-in firewall rules. These ports were only required for SMB1 usage, which is now deprecated and removed by default. This modification aligns SMB firewall rules with the standard behavior of the Windows Server File Server role. Administrators are able to reconfigure the rules to restore the legacy ports.
71
+
72
+To learn more, see [Updated firewall rules](smb-secure-traffic.md#updated-firewall-rules-preview).
73
+
74
+### SMB insecure guest authentication
75
+
76
+By default, Windows 11 Pro no longer permits SMB client guest connections or guest fallback to an SMB server. This brings Windows 11 Pro in line with the behavior of Windows 10 and Windows 11 Enterprise, Education, and Pro for Workstation editions. Guest logons don't require passwords and don't support standard security features like signing and encryption.
77
+
78
+Permitting a client to use guest logons puts the user at risk of adversary-in-the-middle attack scenarios or malicious server scenarios. For instance, a phishing attack that deceives a user into opening a file on a remote share or a spoofed server that convinces a client that it's legitimate. The attacker doesn't need to know the user's credentials, and a weak password is disregarded. Only third-party remote devices may require guest access by default.
79
+
80
+To learn more, see [How to enable insecure guest logons in SMB2 and SMB3](enable-insecure-guest-logons-smb2-and-smb3.md).
81
+
82
+### SMB NTLM blocking
83
+
84
+The SMB client can now prevent New Technology LAN Manager (NTLM) authentication for remote outbound connections. This modifies the previous behavior of always using negotiated authentication that could downgrade from Kerberos to NTLM. By blocking NTLM authentication, this safeguards client devices against sending NTLM requests to malicious servers, thus mitigating brute force, cracking, relay, and pass-the-hash attacks.
85
+
86
+NTLM blocking is necessary for enforcing an organization's authentication to Kerberos, which is more secure because it verifies identities with its ticket system and superior cryptography. Administrators can specify exceptions to permit NTLM authentication over SMB to specific servers.
87
+
88
+To learn more, see:
89
+
90
+- [Block NTLM connections on SMB](smb-ntlm-blocking.md)
91
+
92
+- [SMB NTLM blocking demo video](https://www.youtube.com/watch?v=BPC3plpGt40&t=27m23s)
93
+
94
+### SMB over QUIC client access control
95
+
96
+SMB over QUIC client access control enables you to limit which clients can access SMB over QUIC servers. The previous behavior allowed connection attempts from any client that trusted the QUIC server's certificate issuance chain. With client access control, an *allowlist* and *blocklist* are created for devices to connect to the file server.
97
+
98
+A client must now have its own certificate and be on an **allowlist* to establish the QUIC connection before any SMB connection can occur. Client access control provides organizations with added protection without altering the authentication used during the SMB connection, and the user experience remains unaffected. Additionally, you can disable the SMB over QUIC client entirely or only allow connections to specific servers.
99
+
100
+To learn more, see:
101
+
102
+- [Configure SMB over QUIC client access control in Windows Server 2022 Azure Edition and Windows Server 2025](configure-smb-over-quic-client-access-control.md)
103
+
104
+- [Configure SMB over QUIC client access control demo video](https://www.youtube.com/watch?v=BPC3plpGt40&t=39m36s)
105
+
106
+### SMB over QUIC in Windows Server
107
+
108
+SMB over QUIC is now available in all editions of Windows Server 2025 whereas it was only present in the Azure Edition of Windows Server 2022. SMB over QUIC is an alternative to the outdated TCP protocol and is intended for use on untrusted networks such as the Internet. TLS 1.3 and certificates are used to ensure that all SMB traffic is encrypted, enabling it to be utilized through edge firewalls by mobile and remote users without the need for a VPN.
109
+
110
+To learn more, see:
111
+
112
+- [SMB over QUIC](smb-over-quic.md)
113
+
114
+- [SMB over QUIC demo video](https://www.youtube.com/watch?v=BPC3plpGt40&t=35m30s)
115
+
116
+### SMB Remote Mailslots deprecation
117
+
118
+Remote Mailslots are no longer enabled by default for SMB and DC locator protocol usage with Active Directory (AD), as its deprecated. The Remote Mailslot protocol, which was originally introduced in MS DOS, is now considered obsolete and unreliable. It's also unsafe as it lacks any authentication or authorization mechanisms.
119
+
120
+To learn more, see:
121
+
122
+- [Deprecated features for Windows client](/windows/whats-new/deprecated-features)
123
+
124
+- [Features removed or no longer developed starting with Windows Server 2025](/windows-server/get-started/removed-deprecated-features-windows-server-2025)
125
+
126
+### SMB signing
127
+
128
+Starting with Windows 11 24H2 and Windows Server 2025, all outbound and inbound SMB connections are now required to be signed by default. Previously, SMB signing was only required by default for connections to shares named **SYSVOL** and **NETLOGON**, and for clients of AD domain controllers.
129
+
130
+SMB signing prevents data tampering and relay attacks that steal credentials. By making signing mandatory by default, administrators and users don't need to be experts in SMB network protocol security to enable this important security feature.
131
+
132
+To learn more, see [Control SMB signing behavior](smb-signing.md).
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 09:24 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.