Why this hardening changes your migration plan
Windows 11 24H2 and Windows Server 2025 change the default SMB security posture. Microsoft now requires signing for inbound and outbound SMB connections. This integrity protection mitigates relay attacks and traffic tampering, but it also exposes NAS devices, multifunction printers, Linux systems and applications that still rely on guest access or an incomplete SMB implementation.
Encryption, NTLM blocking and dialect controls complement signing, but should not all be enforced on the same day. A successful migration starts with inventory and auditing, remediates dependencies, then applies one control at a time through deployment rings. Disabling signing to restore an old share should only be a temporary, documented and isolated measure.
What is enabled by default — and what is not
Requiring signing does not encrypt content. Signing protects packet integrity and authenticity; SMB encryption also protects confidentiality. When encryption is negotiated, it also supplies integrity and supersedes signing for that connection.
| Control | Behaviour | Decision |
|---|---|---|
| SMB signing | Required by default inbound and outbound | Keep it; remediate incompatible servers |
| Global SMB encryption | Supported as a client mandate, but must be configured | Target systems that only access SMB 3.x |
| Insecure guest access | Rejected by Windows 11 Pro and incompatible with signing/encryption | Replace it with authenticated accounts |
| SMB NTLM blocking | Available for outbound connections | Audit, create rare exceptions, then block |
| SMB1 | Deprecated and not installed by default on modern releases | Remove rather than re-enable |
1 — Inventory connections and effective settings
Collect results from representative workstations, file servers, domain controllers and application servers. Get-SmbConnection shows active connections and their dialect; Get-SmbSession runs on the server side. A connection missing from the report is not necessarily unused: exercise scheduled jobs, scanning, backup and line-of-business workflows during the observation period.
- Resolve every DNS name in use, including aliases, IP addresses and short names.
- Record the owner, purpose, negotiated protocol and authentication method for each target.
- Test NAS devices and appliances on current firmware.
- Benchmark throughput-sensitive workloads before and after signing or encryption.
Get-SmbClientConfiguration | Select-Object RequireSecuritySignature, RequireEncryption, EnableInsecureGuestLogons
Get-SmbServerConfiguration | Select-Object RequireSecuritySignature, EncryptData, EnableSMB1Protocol, EnableSMB2Protocol
Get-SmbConnection | Select-Object ServerName, ShareName, Dialect, Signed, Encrypted, UserName
Get-SmbSession | Select-Object ClientComputerName, ClientUserName, Dialect, Signed, Encrypted2 — Enable compatibility auditing before enforcement
Windows 11 24H2 and Windows Server 2025 can log a peer that does not support signing or encryption. Enable all four audits through Group Policy under Computer Configuration > Administrative Templates > Network > Lanman Workstation and Lanman Server. Keep collection running for at least one complete operational cycle.
- SMBClient/Audit: events 31998 and 31999.
- SMBServer/Audit: events 3021 and 3022.
- Centralize events in Microsoft Sentinel, Windows Event Forwarding or your SIEM.
- Do not mistake no events for complete coverage: verify that periodic workloads actually ran.
Set-SmbClientConfiguration -AuditServerDoesNotSupportSigning $true -AuditServerDoesNotSupportEncryption $true -Confirm:$false
Set-SmbServerConfiguration -AuditClientDoesNotSupportSigning $true -AuditClientDoesNotSupportEncryption $true -Confirm:$false
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-SMBClient/Audit'; Id=31998,31999} | Select-Object TimeCreated, Id, Message
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-SMBServer/Audit'; Id=3021,3022} | Select-Object TimeCreated, Id, Message3 — Keep mandatory SMB signing
Mandatory signing is the new security baseline. For an explicit GPO, enable Microsoft network client: Digitally sign communications (always) and Microsoft network server: Digitally sign communications (always) under Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options.
Use DNS names that allow Kerberos instead of IP addresses. Microsoft also recommends avoiding a plain CNAME for a file server: register the alternate name with netdom so the required SPNs are associated correctly. This prevents silent fallback to NTLM.
Get-SmbClientConfiguration | Select-Object RequireSecuritySignature
Get-SmbServerConfiguration | Select-Object RequireSecuritySignature
Set-SmbClientConfiguration -RequireSecuritySignature $true -Confirm:$false
Set-SmbServerConfiguration -RequireSecuritySignature $true -Confirm:$false4 — Require encryption where confidentiality warrants it
The new client mandate can require encryption for every outbound connection. It blocks any server that lacks SMB 3.0 or encryption, even if it supports signing. Start with administrative workstations, servers communicating across less trusted segments and flows carrying sensitive data.
The GPO is Computer Configuration > Administrative Templates > Network > Lanman Workstation > Require encryption. On the server, encrypt one share with Set-SmbShare -EncryptData $true or the entire server with Set-SmbServerConfiguration -EncryptData $true. Targeted enforcement limits the blast radius.
Set-SmbClientConfiguration -RequireEncryption $true -Confirm:$false
Get-SmbClientConfiguration | Format-List RequireEncryption
Set-SmbShare -Name 'Finance' -EncryptData $true
Get-SmbShare -Name 'Finance' | Select-Object Name, EncryptData5 — Eliminate guest access instead of bypassing protection
A guest session has no reliable identity and supports neither signing nor encryption. When a 24H2 upgrade breaks an old share, first determine whether the device relies on guest fallback. Create a least-privileged dedicated account, restrict its shares, rotate its password and update Credential Manager or the calling service.
Enabling insecure guest logons or disabling RequireSecuritySignature may restore access, but it reopens the interception scenario the hardening is designed to prevent. If replacement is temporarily impossible, isolate the appliance in a VLAN, restrict TCP 445 to required clients, deny Internet access and set a retirement date.
6 — Audit, then block NTLM for SMB
The modern SMB client can block NTLM for remote outbound connections and maintain an exception list. Before enforcement, ensure clients use the server DNS name, SPNs are correct and Kerberos works. Review Active Directory NTLM auditing as well: blocking SMB does not remediate other NTLM use.
Deploy audit policy to a small ring first, correct aliases and accounts, then move to blocking. Allow an exception only for a specific server name with an owner and expiry date. A broad exception turns the control into security theatre.
- Ring 0: IT staff and labs.
- Ring 1: modern workstations with no known application dependencies.
- Ring 2: member servers and general users.
- Final ring: industrial, archive, scanning and legacy application systems.
7 — Reduce protocol and network exposure
SMB1 is deprecated and should not be re-enabled to rescue an end-of-life device. Verify its absence, then upgrade or replace the dependency. On Windows Server 2025, the newer restrictive file-sharing firewall rules no longer open NetBIOS ports 137–139 automatically. Keep that reduction and allow TCP 445 only from required subnets.
For remote access, never expose TCP 445 directly to the Internet. SMB over QUIC is available in Windows Server 2025 Standard and Datacenter and transports SMB in QUIC with TLS 1.3. It still needs certificates, access control and logging; it does not replace share authentication or authorization.
Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol, EnableSMB2ProtocolDeployment and rollback plan
Prepare rollback before each ring: previous GPO, temporary exclusion group, approval owner and maximum duration. Roll back the most recently enabled control, not the entire hardening baseline. Keep signing if the issue is caused by the encryption mandate or NTLM blocking.
Connect this project to the Kerberos RC4-to-AES migration and the Active Directory security assessment. SMB protection depends as much on identity and SPNs as it does on protocol configuration.
| Phase | Action | Exit criterion |
|---|---|---|
| 1. Discovery | Inventory, signing/encryption audits, NTLM dependencies | Every target has an owner and known compatibility |
| 2. Remediation | Firmware, accounts, DNS/SPNs, replace SMB1/guest | No critical unsigned or guest flow remains |
| 3. Pilot | Signing, targeted encryption, NTLM blocking in ring 0 | No outage and acceptable performance |
| 4. Rollout | Expand one policy at a time | Logs and support tickets remain stable |
| 5. Operations | Alerts, exception review and recovery testing | Temporary exceptions are closed or formally renewed |
Official Microsoft sources
About the author
Marc-Antoine Lambert
Montréal-based senior IT consultant and Team Lead specializing in architecture, cybersecurity, Microsoft infrastructure, networking and business continuity.
Discuss your environment →