ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 23:56 UTC Customize Public modeDiscuss ChangeIntel on Discord

SMB signing requirements

This page's changes and edits · All guidance changes

Microsoft's edit ·

Acrolinx

Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit f77e416 · +14 −18 lines · also on GitHub

11 ---
22 title: Overview of Server Message Block signing in Windows
33 description: Learn how to configure SMB signing, how to determine whether SMB signing is enabled, and how to disable SMB signing.
4 −ms.date: 03/08/2024
4 +ms.date: 03/26/2024
55 author: robinharwood
66 ms.author: wscontent
77 ms.topic: overview
⋯ 2 unchanged lines
1010
1111 # What is Server Message Block signing?
1212
13 −This article describes Server Message Block (SMB) 2.x and 3.x signing in Windows and Windows Server, including how to determine whether SMB signing is required and enabled.
13 +This article describes Server Message Block (SMB) 2.x and 3.x signing in Windows and Windows Server. The article also describes SMB signing security considerations and policy settings.
1414
15 −SMB signing means that every SMB message contains a signature generated using a session key and AES. SMB signing adds a signature containing a hash of the entire message in the SMB header. If someone tampers with the message in transit, the data in the tampered message won't match the hash in the signature. The hash also includes the identities of the original sender and the intended recipient. Signature mismatches alert users to possible foul play, helping them protect their deployments from relay and spoofing attacks.
15 +SMB signing means that every SMB message contains a signature generated using a session key and AES. SMB signing adds a signature containing a hash of the entire message in the SMB header. If someone tampers with the message in transit, the data in the tampered message doesn't match the hash in the signature. The hash also includes the identities of the original sender and the intended recipient. Signature mismatches alert users to possible foul play, helping them protect their deployments from relay and spoofing attacks.
1616
1717 ## How signing works
1818
19 −SMB signing is a security feature that uses the session key and cipher suite to add a signature to a message going across a connection. SMB2 message integrity manifests on a signed session where signed packets flow from client to server. On a signed session, every signed packet includes a signature that the receiver can validate. Unlike SMB1 signing which uses the MD5 [RFC1321] hashing algorithm, SMB2 uses a better hashing for signing. The security model in MS-SMB2 relies upon authenticating the client-user identity before accessing a share on the server. After the user is authenticated, the server can mandate message signing or encryption. The server also controls access to the share based on which users, groups, or claims are authorized to have various levels of access.
19 +SMB signing is a security feature that uses the session key and cipher suite to add a signature to a message going across a connection. SMB2 message integrity manifests on a signed session where signed packets flow from client to server. On a signed session, every signed packet includes a signature that the receiver can validate. Unlike SMB1 signing that uses the MD5 [RFC1321] hashing algorithm, SMB2 uses a better hashing for signing. The security model in MS-SMB2 relies upon authenticating the client-user identity before accessing a share on the server. After the user is authenticated, the server can mandate message signing or encryption. The server also controls access to the share based on which users, groups, or claims are authorized to have various levels of access.
2020
2121 Signing algorithms have evolved over time, with SMB 2.02 signing was improved with HMAC-SHA-256, replacing the old MD5 method that was in SMB1. Additionally, SMB 3.0 introduced AES-CMAC. Windows Server 2022 and Windows 11 introduced AES-128-GMAC signing acceleration. To learn more about the AES-128-GMAC signing, see [AES-128-GMAC signing acceleration](smb-security.md#new-signing-algorithm).
2222
23 −SMB signing is enabled in all versions of Windows. SMB signing requirements can involve both outbound signing, which covers traffic from the SMB client, and inbound signing, which covers traffic to the server. Windows and Windows Server can require outbound signing only, inbound signing only, both, or neither. If your environment uses third-party servers, your system settings can prevent the default settings and connections from taking effect. In this case, you'll want to disable SMB signing. See [Control SMB signing behavior](smb-signing.md) for guidance on how to disable SMB signing.
23 +SMB signing is enabled in all versions of Windows. SMB signing requirements can involve both outbound signing, which covers traffic from the SMB client, and inbound signing, which covers traffic to the server. Windows and Windows Server can require outbound signing only, inbound signing only, both, or neither. If your environment uses non-Microsoft file servers, your system settings can prevent the default settings and connections from taking effect. In this case, you might want to disable SMB signing. See [Control SMB signing behavior](smb-signing.md) for guidance on how to disable SMB signing.
2424
2525 ### Security considerations in SMB2 and SMB3
2626
27 −All cryptographic keys used in SMB 2.x and 3.x signing are derived from the session key. The security of SMB 2/3 signing and encryption relies on the session key. If someone changes a message during transmission, the hash won't match, and SMB will know that someone tampered with the data. The signature also confirms the sender's and receiver's identities. This prevents relay attacks.
27 +All cryptographic keys used in SMB 2.x and 3.x signing are derived from the session key. The security of SMB 2/3 signing and encryption relies on the session key. If someone changes a message during transmission, the hash doesn't match, and SMB knows that someone tampered with the data. The signature also confirms the sender's and receiver's identities, and prevents relay attacks.
2828
29 −You should consider the following when using SMB signing:
29 +When using SMB signing, you should consider:
3030
31 −- Because the session key itself is derived from your password, using a long, complex, non-dictionary password enhances SMB signing and encryption.
31 +- Because the session key itself is derived from your password, using a long, complex, nondictionary password enhances SMB signing and encryption.
3232 - Using Kerberos instead of NTLMv2 is recommended so that your session key starts strong.
33 −- Don't connect to shares by using IP addresses and don't use CNAME records, or you'll use NTLM instead of Kerberos. We recommend using Kerberos. To learn more about alternatives to using a CNAME, see [Using Computer Name Aliases in place of DNS CNAME Records](https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/using-computer-name-aliases-in-place-of-dns-cname-records/ba-p/259064).
33 +- Don't connect to shares by using IP addresses or CNAME records, otherwise NTLM is used instead of Kerberos. We recommend using Kerberos. To learn more about alternatives to using CNAME records, see [Using Computer Name Aliases in place of DNS CNAME Records](https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/using-computer-name-aliases-in-place-of-dns-cname-records/ba-p/259064).
3434
3535 By default, domain controllers require SMB signing of anyone connecting to them, typically for SYSVOL and NETLOGON to get group policy and logon scripts. UNC Hardening from the client also requires signing when talking to those same two shares and goes further by requiring Kerberos.
3636
⋯ 22 unchanged lines
5959 Data Type: `REG_DWORD`
6060 Data: 0 (disable), 1 (enable)
6161
62 −**Note** In these policies, *always* indicates that SMB signing is required, and *if server agrees* or *if client agrees* indicates that SMB signing is enabled.
62 +**Note** In these policies *always* indicates that SMB signing is required, and *if server agrees* or *if client agrees* indicates that SMB signing is enabled.
6363
6464 ### Understanding "RequireSecuritySignature" and "EnableSecuritySignature"
6565
66 −The **EnableSecuritySignature** registry setting for SMB2 and later clients and servers is ignored. Therefore, this setting does nothing unless you're using SMB1. SMB 2.02 and later signing is controlled solely by being required or not. This setting is used when either the server or client requires SMB signing. Only if both have signing set to **0** will signing not occur.
66 +The **EnableSecuritySignature** registry setting for SMB2 and later clients and servers is ignored. Therefore, this setting does nothing unless you're using SMB1. SMB 2.02 and later signing is controlled solely by being required or not. This setting is used when either the server or client requires SMB signing. Signing doesn't occur Only when both the server and client have signing set to **0**.
6767
6868 In summary SMB is signed when:
6969
⋯ 1 unchanged line
7171 - The SMB client has **RequireSecuritySignature** set to **1** and the server has **RequireSecuritySignature** set to **0**.
7272 - The SMB server has **RequireSecuritySignature** set to **1** and the client has **RequireSecuritySignature** set to **0**.
7373
74 −Signing is not used when:
74 +Signing isn't used when:
7575
7676 - The SMB client and server have **RequireSecuritySignature** set to **0**.
7777
7878 ## Related content
7979
80 +The following articles provide additional information about SMB:
81 +
8082 - [Control SMB signing behavior](smb-signing.md)
8183
8284 - [Overview of File Sharing using the SMB 3 protocol in Windows Server](file-server-smb-overview.md)
8385
84 −- [SMB over QUIC](smb-over-quic.md)
85 −
8686 - [SMB security enhancements](smb-security.md)
8787
8888 - [Configure SMB Signing with Confidence](https://techcommunity.microsoft.com/t5/storage-at-microsoft/configure-smb-signing-with-confidence/ba-p/2418102)
89 −
90 −- [SMBv1 is not installed by default in Windows 10 version 1709, Windows Server version 1709 and later versions](/windows-server/storage/file-server/troubleshoot/smbv1-not-installed-by-default-in-windows)
91 −
92 −- [Netdom computername](/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc835082(v=ws.11))

Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 09:45 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 23:56 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.