SMB signing requirements
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit cfefb68 · +3 −13 lines · also on GitHub
⋯ 19 unchanged lines
2020
2121
Signing algorithms have evolved over time, with SMB 2.02 signing was improved with HMAC-SHA-256, replacing the old MD5 method that was in SMB1. Additionally, SMB 3.0 introduced AES-CMAC. Windows Server 2022 and Windows 11 introduced AES-128-GMAC signing acceleration. To learn more about the AES-128-GMAC signing, see [AES-128-GMAC signing acceleration](smb-security.md#new-signing-algorithm).
2222
23
−SMB signing is enabled in all versions of Windows. SMB signing requirements can involve both outbound signing, which covers traffic from the SMB client, and inbound signing, which covers traffic to the server. Windows and Windows Server can require outbound signing only, inbound signing only, both, or neither. If your environment uses non-Microsoft file servers, your system settings can prevent the default settings and connections from taking effect. In this case, you might want to disable SMB signing. See [Control SMB signing behavior](smb-signing.md) for guidance on how to disable SMB signing.
23
+SMB signing is enabled in all versions of Windows. SMB signing requirements can involve both outbound signing, which covers traffic from the SMB client, and inbound signing, which covers traffic to the server. Windows and Windows Server can require outbound signing only, inbound signing only, both, or neither. If your environment uses non-Microsoft file servers, your system settings can prevent the default settings and connections from taking effect. In this case, you might need to disable the requirement for SMB signing. See [Control SMB signing behavior](smb-signing.md) for guidance on how to disable SMB signing.
2424
2525
### Security considerations in SMB2 and SMB3
2626
⋯ 5 unchanged lines
3232
- Using Kerberos instead of NTLMv2 is recommended so that your session key starts strong.
3333
- Don't connect to shares by using IP addresses or CNAME records, otherwise NTLM is used instead of Kerberos. We recommend using Kerberos. To learn more about alternatives to using CNAME records, see [Using Computer Name Aliases in place of DNS CNAME Records](https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/using-computer-name-aliases-in-place-of-dns-cname-records/ba-p/259064).
3434
35
−By default, domain controllers require SMB signing of anyone connecting to them, typically for SYSVOL and NETLOGON to get group policy and logon scripts. UNC Hardening from the client also requires signing when talking to those same two shares and goes further by requiring Kerberos.
35
+By default, domain controllers require SMB signing of anyone connecting to them, typically for SYSVOL and NETLOGON to get group policy and logon scripts. UNC Hardening from the client also requires signing when talking to those same two shares and goes further by requiring Kerberos. SMB signing is also automatically used as part of pre-authentication integrity to prevent downgrade attacks. See [SMB 3.1.1 Pre-authentication integrity in Windows 10](https://learn.microsoft.com/archive/blogs/openspecification/smb-3-1-1-pre-authentication-integrity-in-windows-10?WT.mc_id=ITOPSTALK-blog-abartolo) for more information.
3636
3737
## Policy locations for SMB signing
3838
⋯ 4 unchanged lines
4343
Registry value: **RequireSecuritySignature**
4444
Data Type: `REG_DWORD`
4545
Data: 0 (disable), 1 (enable)
46
−- **Microsoft network client: Digitally sign communications (if server agrees)**
47
− Registry key: `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManWorkstation\Parameters`
48
− Registry value: **EnableSecuritySignature**
49
− Data Type: `REG_DWORD`
50
− Data: 0 (disable), 1 (enable)
5146
- **Microsoft network server: Digitally sign communications (always)**
5247
Registry key: `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters`
5348
Registry value: **RequireSecuritySignature**
5449
Data Type: `REG_DWORD`
5550
Data: 0 (disable), 1 (enable)
56
−- **Microsoft network server: Digitally sign communications (if client agrees)**
57
− Registry key: `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters`
58
− Registry value: **EnableSecuritySignature**
59
− Data Type: `REG_DWORD`
60
− Data: 0 (disable), 1 (enable)
61
−
51
+s
6252
**Note** In these policies *always* indicates that SMB signing is required, and *if server agrees* or *if client agrees* indicates that SMB signing is enabled.
6353
6454
### Understanding "RequireSecuritySignature" and "EnableSecuritySignature"
⋯ 24 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 09:45 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.