SMB signing requirements
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 8dde571 · +92 −0 lines · also on GitHub
The file is new at this commit, or was moved here from another path: every line shows as added.
1
+---
2
+title: Overview of Server Message Block signing in Windows
3
+description: Learn how to configure SMB signing, how to determine whether SMB signing is enabled, and how to disable SMB signing.
4
+ms.date: 03/08/2024
5
+author: robinharwood
6
+ms.author: wscontent
7
+ms.topic: overview
8
+#customer intent: As a IT administrator, I want understand what SMB signing is so that I better support my customers and design secure file storage solutions.
9
+---
10
+
11
+# What is Server Message Block signing?
12
+
13
+This article describes Server Message Block (SMB) 2.x and 3.x signing in Windows and Windows Server, including how to determine whether SMB signing is required and enabled.
14
+
15
+SMB signing means that every SMB message contains a signature generated using a session key and AES. SMB signing adds a signature containing a hash of the entire message in the SMB header. If someone tampers with the message in transit, the data in the tampered message won't match the hash in the signature. The hash also includes the identities of the original sender and the intended recipient. Signature mismatches alert users to possible foul play, helping them protect their deployments from relay and spoofing attacks.
16
+
17
+## How signing works
18
+
19
+SMB signing is a security feature that uses the session key and cipher suite to add a signature to a message going across a connection. SMB2 message integrity manifests on a signed session where signed packets flow from client to server. On a signed session, every signed packet includes a signature that the receiver can validate. Unlike SMB1 signing which uses the MD5 [RFC1321] hashing algorithm, SMB2 uses a better hashing for signing. The security model in MS-SMB2 relies upon authenticating the client-user identity before accessing a share on the server. After the user is authenticated, the server can mandate message signing or encryption. The server also controls access to the share based on which users, groups, or claims are authorized to have various levels of access.
20
+
21
+Signing algorithms have evolved over time, with SMB 2.02 signing was improved with HMAC-SHA-256, replacing the old MD5 method that was in SMB1. Additionally, SMB 3.0 introduced AES-CMAC. Windows Server 2022 and Windows 11 introduced AES-128-GMAC signing acceleration. To learn more about the AES-128-GMAC signing, see [AES-128-GMAC signing acceleration](../storage/file-server/smb-security.md#new-signing-algorithm).
22
+
23
+SMB signing is enabled in all versions of Windows. SMB signing requirements can involve both outbound signing, which covers traffic from the SMB client, and inbound signing, which covers traffic to the server. Windows and Windows Server can require outbound signing only, inbound signing only, both, or neither. If your environment uses third-party servers, your system settings can prevent the default settings and connections from taking effect. In this case, you'll want to disable SMB signing. See [Control SMB signing behavior](smb-signing.md) for guidance on how to disable SMB signing.
24
+
25
+### Security considerations in SMB2 and SMB3
26
+
27
+All cryptographic keys used in SMB 2.x and 3.x signing are derived from the session key. The security of SMB 2/3 signing and encryption relies on the session key. If someone changes a message during transmission, the hash won't match, and SMB will know that someone tampered with the data. The signature also confirms the sender's and receiver's identities. This prevents relay attacks.
28
+
29
+You should consider the following when using SMB signing:
30
+
31
+- Because the session key itself is derived from your password, using a long, complex, non-dictionary password enhances SMB signing and encryption.
32
+- Using Kerberos instead of NTLMv2 is recommended so that your session key starts strong.
33
+- Don't connect to shares by using IP addresses and don't use CNAME records, or you'll use NTLM instead of Kerberos. We recommend using Kerberos. To learn more about alternatives to using a CNAME, see [Using Computer Name Aliases in place of DNS CNAME Records](https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/using-computer-name-aliases-in-place-of-dns-cname-records/ba-p/259064).
34
+
35
+By default, domain controllers require SMB signing of anyone connecting to them, typically for SYSVOL and NETLOGON to get group policy and logon scripts. UNC Hardening from the client also requires signing when talking to those same two shares and goes further by requiring Kerberos.
36
+
37
+## Policy locations for SMB signing
38
+
39
+The policies for SMB signing are located in **Computer Configuration** > **Windows Settings** > **Security Settings** > **Local Policies** > **Security Options**.
40
+
41
+- **Microsoft network client: Digitally sign communications (always)**
42
+ Registry key: `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManWorkstation\Parameters`
43
+ Registry value: **RequireSecuritySignature**
44
+ Data Type: `REG_DWORD`
45
+ Data: 0 (disable), 1 (enable)
46
+- **Microsoft network client: Digitally sign communications (if server agrees)**
47
+ Registry key: `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManWorkstation\Parameters`
48
+ Registry value: **EnableSecuritySignature**
49
+ Data Type: `REG_DWORD`
50
+ Data: 0 (disable), 1 (enable)
51
+- **Microsoft network server: Digitally sign communications (always)**
52
+ Registry key: `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters`
53
+ Registry value: **RequireSecuritySignature**
54
+ Data Type: `REG_DWORD`
55
+ Data: 0 (disable), 1 (enable)
56
+- **Microsoft network server: Digitally sign communications (if client agrees)**
57
+ Registry key: `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters`
58
+ Registry value: **EnableSecuritySignature**
59
+ Data Type: `REG_DWORD`
60
+ Data: 0 (disable), 1 (enable)
61
+
62
+**Note** In these policies, *always* indicates that SMB signing is required, and *if server agrees* or *if client agrees* indicates that SMB signing is enabled.
63
+
64
+### Understanding "RequireSecuritySignature" and "EnableSecuritySignature"
65
+
66
+The **EnableSecuritySignature** registry setting for SMB2 and later clients and servers is ignored. Therefore, this setting does nothing unless you're using SMB1. SMB 2.02 and later signing is controlled solely by being required or not. This setting is used when either the server or client requires SMB signing. Only if both have signing set to **0** will signing not occur.
67
+
68
+In summary SMB is signed when:
69
+
70
+- Both the SMB client and server have **RequireSecuritySignature** set to **1**.
71
+- The SMB client has **RequireSecuritySignature** set to **1** and the server has **RequireSecuritySignature** set to **0**.
72
+- The SMB server has **RequireSecuritySignature** set to **1** and the client has **RequireSecuritySignature** set to **0**.
73
+
74
+Signing is not used when:
75
+
76
+- The SMB client and server have **RequireSecuritySignature** set to **0**.
77
+
78
+## Related content
79
+
80
+- [Control SMB signing behavior](../storage/file-server/smb-signing.md)
81
+
82
+- [Overview of File Sharing using the SMB 3 protocol in Windows Server](file-server-smb-overview.md)
83
+
84
+- [SMB over QUIC](smb-over-quic.md)
85
+
86
+- [SMB security enhancements](smb-security.md)
87
+
88
+- [Configure SMB Signing with Confidence](https://techcommunity.microsoft.com/t5/storage-at-microsoft/configure-smb-signing-with-confidence/ba-p/2418102)
89
+
90
+- [SMBv1 is not installed by default in Windows 10 version 1709, Windows Server version 1709 and later versions](/windows-server/storage/file-server/troubleshoot/smbv1-not-installed-by-default-in-windows)
91
+
92
+- [Netdom computername](/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc835082(v=ws.11))
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 09:45 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.