Enforce SMB Signing

🔒 Secure Bits 💡
𝗘𝗻𝗳𝗼𝗿𝗰𝗶𝗻𝗴 𝗦𝗠𝗕 𝗦𝗶𝗴𝗻𝗶𝗻𝗴: 𝗦𝘁𝗶𝗹𝗹 𝗮 𝗖𝗵𝗮𝗹𝗹𝗲𝗻𝗴𝗲 𝗶𝗻 𝟮𝟬𝟮𝟱?

SMB Signing is one of those security controls that everyone should have in place — 𝘆𝗲𝘁, 𝗺𝗮𝗻𝘆 𝗽𝗿𝗼𝗱𝘂𝗰𝘁𝗶𝗼𝗻 𝗲𝗻𝘃𝗶𝗿𝗼𝗻𝗺𝗲𝗻𝘁𝘀 𝘀𝘁𝗶𝗹𝗹 𝗱𝗼𝗻’𝘁.

💡𝗪𝗵𝘆?
Until now, it’s been difficult to track which clients or applications would break once you enforce it.

While you could run Get-SmbConnection | FL * from the client side to check signing/encryption status and SMB version, 𝘁𝗵𝗶𝘀 𝗱𝗼𝗲𝘀𝗻’𝘁 𝘀𝗰𝗮𝗹𝗲 𝘄𝗲𝗹𝗹.

But that’s changing with Windows Server 2025 and Windows 11 24H2.

🆕 𝗜𝗺𝗽𝗿𝗼𝘃𝗲𝗱 𝗔𝘂𝗱𝗶𝘁𝗶𝗻𝗴 𝗳𝗼𝗿 𝗦𝗠𝗕 𝗦𝗶𝗴𝗻𝗶𝗻𝗴 𝗮𝗻𝗱 𝗘𝗻𝗰𝗿𝘆𝗽𝘁𝗶𝗼𝗻
You can now audit clients and servers that do not support SMB signing or encryption via Event Logs. Here’s how:

🛠️ 𝗚𝗣𝗢 𝗦𝗲𝘁𝘁𝗶𝗻𝗴𝘀
▪️ Computer ConfigurationAdministrative TemplatesNetwork:
🔹 Lanman WorkstationAudit server does not support encryption
🔹 Lanman WorkstationAudit server does not support signing
🔹 Lanman ServerAudit client does not support encryption
🔹 Lanman ServerAudit client does not support signing

📁 𝗘𝘃𝗲𝗻𝘁 𝗟𝗼𝗴 𝗣𝗮𝘁𝗵𝘀 & 𝗘𝘃𝗲𝗻𝘁𝘀
▪️ Applications and Services LogsMicrosoftWindows:
🔹 SMBServerAudit
🔹 SMBClientAudit
➡️ Events: 3021–3027

📁 𝗧𝗵𝗲𝗿𝗲’𝘀 𝗮𝗹𝘀𝗼 𝗲𝘃𝗲𝗻𝘁 𝟰𝟬𝟬𝟬, 𝗹𝗼𝗰𝗮𝘁𝗲𝗱 𝗮𝘁:
▪️ Applications and Services LogsMicrosoftWindows:
🔹 SMBServerConnectivity
🔹 SMBClientConnectivity
This seems to be enabled by default in WS2025 and is not controlled by the GPOs above.

⚠️ There was also a Patch Tuesday update (𝗖𝗩𝗘-𝟮𝟬𝟮𝟱-𝟱𝟱𝟮𝟯𝟰) that should backport these auditing features to older Windows versions — but I haven’t been able to reproduce that yet (maybe I misunderstood this CVE). I also found out that registry values are different between WS 2025 and older versions of WS.

𝗔𝘁 𝗹𝗮𝘀𝘁, 𝘄𝗲 𝗰𝗮𝗻 𝗮𝘂𝗱𝗶𝘁 𝘁𝗵𝗶𝘀 𝗮𝘁 𝘀𝗰𝗮𝗹𝗲 — from the server side — and plan for a safe SMB hardening rollout.

𝗔𝗿𝗲 𝘆𝗼𝘂 𝗶𝗻𝘁𝗲𝗿𝗲𝘀𝘁𝗲𝗱 𝗶𝗻 𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆? Check out my free resources:
👉 https://academy.horizon-secured.com/p/free-resources