SMB Signing Disabled

Question

have a Windows Server 2019 Standard machine where I am trying to fix the "SMB Signing Disabled or SMB Signing Not Required" vulnerability, but I change the keys below to 1

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManWorkstation\Parameters

Registry value: RequireSecuritySignature and EnableSecuritySignature

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters

Registry value: RequireSecuritySignature and EnableSecuritySignature

and when I return to validate the value is 0 again.

https://learn.microsoft.com/en-us/archive/blogs/josebda/the-basics-of-smb-signing-covering-both-smb1-and-smb2

We don't have policies applied by GPO on the servers, but none of them force the value of this key to change.

Answer 1

Hello

SMB is signed when:

• Both the SMB client and server have RequireSecuritySignature set to 1.
• The SMB client has RequireSecuritySignature set to 1 and the server has RequireSecuritySignature set to 0.
• The SMB server has RequireSecuritySignature set to 1 and the client has RequireSecuritySignature set to 0.

Signing isn't used when:

• The SMB client and server have RequireSecuritySignature set to 0.

You should also follow these recommendations to ensure your SMB signatures are effective at securing your data:

• Use Kerberos instead of NTLMv2.
• Don't connect to shares using IP addresses.
• Don't use CNAME DNS records. Instead, assign alternate computer names with NETDOM.EXE.

https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-signing-overview

Regards,

Karlie