What breaks when SMB signing is not enforced on domain-joined systems?

Why This Matters for Security Teams

SMB signing is not a cosmetic hardening setting. On domain-joined Windows systems, it is one of the mechanisms that helps prove the integrity of SMB sessions and reduces the value of intercepted authentication material. When it is not enforced, attackers can pivot from simple network positioning into relay-based privilege abuse, turning otherwise routine file and admin traffic into a path for credential misuse. That risk becomes more serious in environments that still rely on legacy file shares, remote administration, or broad workstation-to-server trust.

This is why guidance such as the NIST Cybersecurity Framework 2.0 continues to emphasise protect and detect controls around trusted communications, even when the protocol itself predates modern zero trust thinking. In practice, unsigned SMB is often discovered only after an attacker has already relayed authentication from one host to another, rather than through deliberate control testing or policy review.

How It Works in Practice

SMB signing adds a cryptographic integrity check to SMB traffic so the receiver can verify that the request was not altered in transit and did not come from an attacker simply relaying someone else’s authentication exchange. On domain-joined systems, that matters because the attack surface is usually not anonymous access; it is trusted Windows authentication moving across the network under assumptions that are easy to abuse.

When signing is not required, an attacker in a man-in-the-middle position can capture or relay authentication attempts into a different SMB session. That can let the attacker authenticate to a target service as the victim, especially when the target also accepts privileges that the relayed identity should never have received. The control is therefore less about secrecy and more about session authenticity.

• Require SMB signing on servers and clients where policy allows.
• Validate that domain controllers, file servers, and admin workstations do not accept unsigned SMB.
• Pair SMB signing with least privilege so relayed access has limited value.
• Test for relay exposure during change windows, not only during incident response.

For broader NHI governance, this is analogous to what happens when a workload identity or secret is accepted without strong integrity checks: the system trusts the channel more than the origin. NHIMG has repeatedly documented how weakly protected credentials and identities get abused once attackers can position themselves in the path, including in the Schneider Electric credentials breach and the DeepSeek breach. These controls tend to break down in mixed Windows estates where older servers, appliance-style SMB implementations, or compatibility exceptions prevent signing from being uniformly enforced.

Common Variations and Edge Cases

Tighter SMB signing often increases compatibility overhead, requiring organisations to balance relay resistance against legacy interoperability. That tradeoff is real in environments with older NAS devices, embedded systems, print infrastructure, or third-party appliances that still negotiate SMB in limited modes.

Current guidance suggests treating exceptions as temporary and explicitly scoped, not as a permanent carve-out. If signing cannot be required everywhere, then compensating controls become more important: isolate the affected segment, restrict admin logon paths, monitor for anomalous SMB session negotiation, and eliminate unnecessary lateral movement paths. There is no universal standard for this yet, but best practice is to make unsigned SMB a documented exception with an expiry date.

Security teams should also remember that SMB signing does not fix weak credential hygiene, overprivileged accounts, or poor tiering of admin access. It blocks one class of relay abuse, but it does not stop a compromised host from being used as a launch point for other authenticated attacks. In practice, the hardest failures appear where signing is partially enabled, exceptions are poorly tracked, and attackers deliberately target the least modern server in the domain.

Related resources from NHI Mgmt Group

• What breaks when an agent has broad write access across business systems?
• What breaks when bootloader signing keys are exposed?
• What breaks when ransomware recovery restores systems but not identity paths?
• What breaks when identity systems are only tested on the happy path?