MicrosoftI love the new audit events. How can I test them? Where do I get an SMB 2 client that does not support signing oder an SMB 3 client that does not support encryption? (Or servers?).
MicrosoftHi Paul-Blenderman - For SMB2 you could disable signing via the RequireSecuritySignature registry valule as documented here. However, that would require setting RequireSecuritySignature=0 on both the client and the server in order for signing to not be negotiated.
To my knowledge there is no MSFT SMB 3.0 client that does not support encryption but for testing purposes you could disable it at that share level (Set-SmbShare –Name <sharename> -EncryptData $false) or server level (Set-SmbServerConfiguration –EncryptData $false) as documented here.
For what it is worth this is an example of a warning event that will be log if a client has had signing disabled via RequireSecuritySignature
By setting EnableSecuritySignature and RequireSecuritySignature to false in both the client as well as the server configuration, I can make connections that do not use Signing. With AuditClientDoesNotSupportSigning set to true, this does however not result in the audit event 3021. When I enable RequireSecuritySignature on the server side, the connection will always use Signing, even if EnableSecuritySignature is off on the client side. I guess whoever produced the screenshot (not you?) had a tweaked client? Thanks anyway!
