Heya folks, Ned here again. Many years ago, we made configuring SMB signing in Windows pretty complicated. Then, years later, we made it even more complicated in an attempt to be less complicated. To...
Updated Nov 09, 2023
Version 14.0
Blog Post
Hi Karim,
You may require SMB signing on the SMB client side (on Windows client and Windows Server), even without UNC Hardening. This way you only enforce SMB signing on a set of SMB clients. Note you can require SMB signing also on the SMB client of the systems acting as an SMB server.
Signing is supported since Windows 98 and Windows NT 4.0 SP3 (backported to the implementation technically called CIFS) and it depends on the Windows version how to enable it. It can be done through Group Policy (although not on Windows 98).
If you do it through UNC Hardening (managed through GP), be aware this is introduced for Windows Vista and WS08, so older Windows versions aren't supported.
Concerning SMB 3.1.1 (= 3.11): this is introduced with Windows Server (version 1607+) and Windows 10. Those Windows versions automatically support SMB 3.1.1, so you don't have to do anything. If they effectively negotiate SMB 3.1.1, pre-auth integrity is active automatically.
Secure Dialect Negotiation is used by default (although it can be disabled) with SMB 3.0 and 3.0.2, which are supported in Windows 8(.1) and WS12(R2) (and higher), and Windows 8.1 and WS12R2 (and higher) respectively.
You can do SMB client mandating starting from Windows 10 Version 1709 and Windows Server version 1709: this way you can determine what the minimum and maximum SMB version allowed is for the SMB client in casu. For example: if you know a certain SMB client X should never connect with something lower than SMB 3.1.1, then you could enforce the SMB client to only use this particular version by setting 3.1.1 as the minimum and maximum version (which can be done without setting the maximum version explicitly (the default), as this means the highest version supported by that machine will be the maximum).
Let' say that SMB mandating could be used as an extra security layer to block negotations which shouldn't occur. Note however that if you're wrong in thinking certain negotiations shouldn't occur this mandating can block things you actually don't want to block 🙂
If you need practical guidance (GP policies, reg values,...) or extra information, well, just ask 🙂
Pedro