SMB signing requirements
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 7cb242f · +34 −3 lines · also on GitHub
11
---
22
title: Overview of Server Message Block signing in Windows
33
description: Learn how to configure SMB signing, how to determine whether SMB signing is enabled, and how to disable SMB signing.
4
−ms.date: 03/26/2024
4
+ms.date: 04/19/2024
55
author: robinharwood
66
ms.author: wscontent
77
ms.topic: overview
8
−#customer intent: As a IT administrator, I want understand what SMB signing is so that I better support my customers and design secure file storage solutions.
8
+#customer intent: As an IT administrator, I want to understand what SMB signing is so that I can better support my customers and design secure file storage solutions.
99
---
1010
1111
# What is Server Message Block signing?
⋯ 20 unchanged lines
3232
- Using Kerberos instead of NTLMv2 is recommended so that your session key starts strong.
3333
- Don't connect to shares by using IP addresses or CNAME records, otherwise NTLM is used instead of Kerberos. We recommend using Kerberos. To learn more about alternatives to using CNAME records, see [Using Computer Name Aliases in place of DNS CNAME Records](https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/using-computer-name-aliases-in-place-of-dns-cname-records/ba-p/259064).
3434
35
−By default, domain controllers require SMB signing of anyone connecting to them, typically for SYSVOL and NETLOGON to get group policy and logon scripts. UNC Hardening from the client also requires signing when talking to those same two shares and goes further by requiring Kerberos. SMB signing is also automatically used as part of pre-authentication integrity to prevent downgrade attacks. See [SMB 3.1.1 Pre-authentication integrity in Windows 10](/archive/blogs/openspecification/smb-3-1-1-pre-authentication-integrity-in-windows-10?WT.mc_id=ITOPSTALK-blog-abartolo) for more information.
35
+By default, domain controllers require SMB signing of anyone connecting to them, typically for SYSVOL and NETLOGON to get group policy and logon scripts. UNC Hardening from the client also requires signing when talking to those same two shares and goes further by requiring Kerberos. SMB signing is also automatically used as part of pre-authentication integrity to prevent downgrade attacks. For more information, see [SMB 3.1.1 Pre-authentication integrity in Windows 10](/archive/blogs/openspecification/smb-3-1-1-pre-authentication-integrity-in-windows-10?WT.mc_id=ITOPSTALK-blog-abartolo).
3636
3737
## Policy locations for SMB signing
3838
⋯ 27 unchanged lines
6666
Signing isn't used when:
6767
6868
- The SMB client and server have **RequireSecuritySignature** set to **0**.
69
+
70
+## SMB signing and encryption auditing
71
+
72
+Starting with Windows 11 Insider build 26090, administrators can enable auditing for the SMB client to detect third-party clients or servers that don't support SMB encryption or signing. If a third-party device or software claims to support SMB 3.1.1, but doesn't support SMB signing, it violates the [SMB 3.1.1 pre-authentication integrity](/archive/blogs/openspecification/smb-3-1-1-pre-authentication-integrity-in-windows-10) protocol requirement.
73
+
74
+Adjusting the SMB signing and encryption auditing settings can be modified in Group Policy or through PowerShell. These settings for Group Policy are stored in the paths:
75
+
76
+- `Computer Configuration\Administrative Templates\Network\Lanman Server\Audit client does not support encryption`
77
+
78
+- `Computer Configuration\Administrative Templates\Network\Lanman Server\Audit client does not support signing`
79
+
80
+- `Computer Configuration\Administrative Templates\Network\Lanman Workstation\Audit server does not support encryption`
81
+
82
+- `Computer Configuration\Administrative Templates\Network\Lanman Workstation\Audit server does not support signing`
83
+
84
+For PowerShell, running the following commands enables auditing the same settings:
85
+
86
+```powershell
87
+Set-SmbServerConfiguration -AuditClientDoesNotSupportEncryption $true
88
+Set-SmbServerConfiguration -AuditClientDoesNotSupportSigning $true
89
+
90
+Set-SmbClientConfiguration -AuditServerDoesNotSupportEncryption $true
91
+Set-SmbClientConfiguration -AuditServerDoesNotSupportSigning $true
92
+```
93
+
94
+The Event Viewer captures these events under the following paths with their respective Event IDs:
95
+
96
+|Path|Event ID|
97
+|-|-|
98
+|Applications and Services Logs\Microsoft\Windows\SMBClient\Audit|31998 <br> 31999|
99
+|Applications and Services Logs\Microsoft\Windows\SMBServer\Audit|3021 <br> 3022|
69100
70101
## Related content
71102
⋯ 9 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 09:45 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.