GPO UNC Hardening with Privacy not working when Hostname contains a hyphen

Netw0rkDude 1 Reputation point
2021-09-28T10:59:23.717+00:00

We had several Windows Server which contained a hyphen in their Hostname. For example, vm-hostname1
We enabled UNC Hardening via GPO for all shares on the relevant hosts and want to ensure that Encryption (Privacy) is activated.

\vm-hostname1.example.domain\* RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1

When we check the SMB session details from the client via Powershell:

Get-SmbConnection | Select-Object -Property *

SmbInstance : Default
ContinuouslyAvailable : False
Credential : xxxx\xxxx
Dialect : 3.1.1
Encrypted : False
NumOpens : 1
Redirected : False

Output omitted.....

We also had some hosts without a hyphen in their hostname. On these Hosts the UNC Hardening with Privacy is working. SMB Session is encrypted.

After struggling a bit around with the Problem, we located the hyphen in the Hostname. When a hyphen is present in the hostname, the UNC Hardening settings are ignored and encryption is not activated.

I know Encryption could also be activated global on a server with Set-SmbServerConfiguration -EncryptData $true. It seems to be a Bug and the Registry Values are not parsed correct.

Our prefered way is to enable encryption via UNC Hardening GPO. But it seems to be a bug.

Any Suggestions?

Windows
Windows
A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.
4,798 questions
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,205 questions
Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,767 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,732 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Limitless Technology 39,391 Reputation points
    2021-09-28T16:39:37.907+00:00

    Hello Netw0rkDude,

    Thank you for your question.

    We have a topic with a problem similar to yours, I recommend you see the article below:

    https://social.technet.microsoft.com/Forums/en-us/7ff4bafa-a65a-4741-83a2-b9e0cf1e36b3/hardened-unc-path-gpo-question?forum=winserverGP

    If the answer is helpful, please vote positively and accept as an answer.

  2. Garan Williams 1 Reputation point
    2022-12-23T19:25:49.37+00:00

    Sorry for the thread bump, but this post was quite helpful to me and I thought I could help others.

    For anyone else that comes across this post, if you use Wireshark to monitor the traffic you can tell if its Signed or Encrypted.

    The PowerShell command on the client doesn't show the connection is Signed or Encrypted, even if it really is Signed or Encrypted as seen via Wireshark. From what I can gather, it only shows Encrypted or Signed if it's required via a GPO or the Client/Server has it required.

    Get-SmbConnection | FL ServerName,ShareName,Signed,Encrypted

    If within the UNC hardening for a \servername\ or \domainname.com\DFSNamespace and you have RequireMutualAuthentication=1, RequireIntegrity=1 as the hardening value, the SMB messages are signed.

    If the hardening value is "RequireMutualAuthentication=1, RequireIntegrity=1, RequirePrivacy=1" then the SMB messages are Encrypted.

    If the hardening value is nothing or there isn't a server or share entry, it's up to the client and server to negotiate their settings based on their own configuration.

    For determining if signing is being used, after the session setup you will see if the host is doing signing or not by checking if the smb signature blob in the smb header is 0 or not.

    I tested this with and without hyphens in the SMB servername.

    There's also a difference when it comes to Shares versus server name.

    For example, if you have \domainname.com\DFSNamespace set to require Signing (via UNC Hardening), but the underlying DFS target server \servername you have set to require encryption (again via UNC Hardening), it doesn't force encryption for the \domainname.com\DFSNamespace SMB connection.

    0 comments