SMB Signing Guide: Enforcing Signing Without Breaking Things

Unsigned SMB sessions let an adversary in the network path tamper with file traffic or relay a user's authentication to another server, and many estates still allow them. SMB signing adds a cryptographic signature to every SMB message so the receiver can detect tampering and confirm it is talking to the party that authenticated. Windows 11 24H2 and Windows Server 2025 changed the defaults, which is why some organisations met signing for the first time as a broken NAS share. This guide explains what signing does, how the settings interact, what breaks, and how to enforce it safely. It is for Windows server, storage and endpoint engineers and the security teams who set their baselines.

Key takeaways

• Signing is about integrity and identity, not secrecy. It detects altered messages and defeats SMB relay, but it does not encrypt file contents; SMB encryption does that.
• Either side can demand it. If the client or the server requires signing, the session is signed. It is skipped only when neither requires it.
• Defaults changed in 2024. Windows 11 24H2 Enterprise, Pro and Education require signing inbound and outbound; Windows Server 2025 requires it outbound; domain controllers already required it from clients.
• Most breakage is third-party or guest access. Older NAS devices and printers that do not sign, and shares reached as a guest, fail when signing is required. Microsoft advises fixing the device rather than disabling signing.
• Signing is only as strong as the session key. Use Kerberos, not NTLM, connect by name rather than IP address or CNAME, and keep passwords long.

What it is

Server Message Block (SMB, TCP 445) is the Windows file sharing protocol, also used for named pipes and many management functions. SMB signing computes a signature over each message using a key derived from the session key negotiated at authentication. The signature covers the whole message and the identities of sender and recipient, so a message altered in transit no longer verifies, and an adversary who does not hold the session key cannot produce valid traffic. Microsoft describes signing as protection against tampering and against relay and spoofing attacks, and MITRE ATT&CK lists enabling SMB signing as a mitigation (M1037) for T1557.001 Name Resolution Poisoning and SMB Relay. See the NTLM Relay Guide.

How it works

Signing is controlled by two Group Policy settings under Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options. "Always" in the policy name means required.

• Negotiation: signing is used if either side requires it. Requiring it on servers protects inbound sessions from any client; requiring it on clients protects users who connect to a spoofed or relaying server.
• Domain controllers: DCs require signing from clients, and UNC Hardening on clients requires signing and Kerberos for SYSVOL and NETLOGON.
• Pre-authentication integrity: SMB 3.1.1 uses signing to stop downgrade of the negotiation. A device that claims 3.1.1 but cannot sign violates that requirement.
• Guest access: requiring signing disables guest access to shares, because a guest session has no key to sign with.
• Checking state: Get-SmbClientConfiguration and Get-SmbServerConfiguration report RequireSecuritySignature as True or False.

Defaults by version

Why it matters

Without required signing, any server that accepts NTLM over SMB is a relay target, and any client that will talk to an unsigned server can be fed altered responses. Relay of privileged machine and service accounts to file servers gives remote access without a password. Signing closes the SMB side of that path for the cost of a configuration change, which makes it one of the best value controls in a Windows estate. See the Windows Server Hardening Guide.

Enforcing signing without breaking things

1. Audit capability first. On Windows 11 24H2 and Server 2025, enable the SMB audit settings (AuditClientDoesNotSupportSigning on servers, AuditServerDoesNotSupportSigning on clients, and the matching encryption settings). Collect SMBServer/Audit events 3021 and 3022 and SMBClient/Audit events 31998 and 31999 to list peers that cannot sign.
2. Inventory third-party SMB. NAS devices, printers and scanners that save to shares, Linux and macOS file services, and appliances. Check each vendor supports signing and enable it on the device.
3. Remove guest shares. Replace guest or anonymous access with authenticated access; you cannot keep both guest access and required signing.
4. Fix the session key. Point scripts, mappings and applications at host names rather than IP addresses or CNAMEs (Microsoft recommends netdom alternate computer names instead of CNAMEs) so Kerberos is used.
5. Pilot in rings. Require signing on a pilot group of servers and clients. Watch for STATUS_INVALID_SIGNATURE (0xc000a000, "The cryptographic signature is invalid") against third-party servers, and guest errors such as 0x80070035 or "System error 3227320323".
6. Enforce in waves. Servers holding sensitive data and Tier 0 and Tier 1 systems first, then the broad server estate, then clients through baseline GPO or Intune.
7. Handle exceptions narrowly and roll back cleanly. If a device truly cannot sign, isolate it on a segment and record an owner and replacement date. Revert by restoring the previous GPO version for the affected ring, never by disabling client signing estate-wide.

Signing, encryption or both

Detection and measurement

• Configuration drift: report RequireSecuritySignature across servers and clients from your configuration management tool.
• Audit events: trend SMB audit events 3021, 3022, 31998 and 31999 toward zero.
• Authentication protocol: event 4624 network logons with Authentication Package NTLM to file servers show where signing is weaker than it should be. See the Windows Event Log Guide.

Metrics: percentage of servers and clients with signing required; count of peers that cannot sign; open signing exceptions and their age; share of SMB logons using NTLM; number of guest-accessible shares (target zero).

Common failure patterns

• Only the "if agrees" settings are configured. Baselines set EnableSecuritySignature and report compliance, while RequireSecuritySignature stays 0 on both sides. For SMB 2 and 3 nothing is actually required, so relay to file servers still works.
• Client-side signing disabled to rescue one device. A help desk fix for a legacy NAS after the 24H2 upgrade is pushed by GPO to every laptop. The NAS works again and every client now accepts unsigned servers. Scope the exception to the device, or replace it.
• Servers left on optional signing because domain controllers already require it. DC enforcement protects SYSVOL and NETLOGON only. Member file servers, application servers and management hosts still accept unsigned sessions unless their own server policy is set.
• Scripts and scheduled tasks mapped by IP address. Sessions are signed, but with NTLM-derived keys, and those service accounts keep NTLM alive across the estate. Migrating paths to host names is cheap and lets Kerberos take over.
• Audit events collected but never reviewed. The 24H2 audit settings are switched on, events 31998 and 3021 accumulate locally, and enforcement day still produces outages. Forward them to the SIEM and assign each device found to an owner before the enforcement date.
• SMB 1 left installed for one old application. SMB 1 signing uses the weak legacy algorithm and its presence keeps older behaviours available. Isolate the application and remove SMB 1 from everything else.

Framework mapping

Common misconceptions

• "Signing encrypts my files." It does not. It proves integrity and origin; use SMB encryption for confidentiality.
• "Enabled means required." Only the "always" policies require signing. The "if client/server agrees" settings are ignored by SMB 2.02 and later.
• "Disable client signing to fix the NAS." That weakens every connection the client makes. Microsoft does not recommend disabling signing as a workaround; fix or isolate the device.
• "Signing stops all relay." It protects SMB targets. Relay to LDAP, AD CS web enrolment or Exchange needs LDAP signing, channel binding and EPA.
• "Signed NTLM sessions are as good as Kerberos." The signing key derives from the session key, which with NTLM depends on the password. Microsoft recommends Kerberos over NTLMv2 and has deprecated NTLM.

Related concepts

• NTLM reduction: SMB NTLM blocking (Lanman Workstation: Block NTLM (LM, NTLM, NTLMv2)) on Windows 11 24H2 and Server 2025 stops clients sending NTLM over SMB at all, with an exception list for servers that need it.
• Kerberos: the authentication that gives signing its strongest key. See the Kerberos Security Guide.
• Segmentation: limits who can reach TCP 445 at all. See the Network Segmentation Guide.
• Where identity fits: service accounts and scanners that map drives by IP address quietly fall back to NTLM. Fixing their connection strings is an identity hygiene task as much as a storage one.

Practitioner checklist

• Report signing state (RequireSecuritySignature) for every server and client.
• Enable SMB signing audit on 24H2 and Server 2025 systems and collect events 3021, 3022, 31998 and 31999.
• Confirm signing support on every NAS, printer and appliance that serves or uses SMB.
• Remove guest and anonymous share access.
• Replace IP address and CNAME paths with host names so Kerberos is used.
• Require server signing on Tier 0 and Tier 1 first, then estate-wide.
• Keep an exception register with owner, segment and replacement date.
• Remove SMB 1 wherever it remains.

Standards and references

• Microsoft Learn: Overview of Server Message Block signing
• Microsoft Learn: Control SMB signing behavior
• Microsoft Learn: Block NTLM connections on SMB
• Microsoft Learn: Deprecated features in the Windows client
• MITRE ATT&CK: Name Resolution Poisoning and SMB Relay
• Microsoft Security Response Center: Mitigating NTLM Relay Attacks by Default
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: NTLM Relay Guide · Windows Server Hardening Guide · Lateral Movement Guide · Active Directory and Entra ID Hardening Guide