Enforce SMB Client Signing Using Regedit

Enforcing Server Message Block (SMB) client signing protects your outbound network traffic against man-in-the-middle (MitM) and tampering attacks by cryptographically verifying the integrity of every SMB packet. This guide outlines the exact steps required to configure your Windows system to strictly require SMB signing for all outbound connections using the Registry Editor (Regedit).

Step 1: Open the Registry Editor

  1. Press Windows Key + R to open the Run dialog box.
  2. Type regedit and press Enter (or click OK).
  3. If prompted by User Account Control (UAC), click Yes to grant administrative privileges.

Step 2: Navigate to the SMB Client Key

In the Registry Editor address bar at the top, paste the following path and press Enter:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters

Step 3: Configure the Required Registry Values

To enforce strict SMB signing, you must configure two specific DWORD (32-bit) values within the Parameters key:

  1. RequireSecuritySignature
    • Look for the value named RequireSecuritySignature in the right pane.
    • If it does not exist, right-click an empty area in the right pane, select New > DWORD (32-bit) Value, and name it RequireSecuritySignature.
    • Double-click RequireSecuritySignature, set the Value data to 1, ensure the base is Hexadecimal, and click OK.
  2. EnableSecuritySignature
    • Look for the value named EnableSecuritySignature.
    • If it does not exist, right-click, select New > DWORD (32-bit) Value, and name it EnableSecuritySignature.
    • Double-click EnableSecuritySignature, set the Value data to 1, ensure the base is Hexadecimal, and click OK.

Step 4: Apply the Changes

Registry changes for the SMB client require a system restart to take full effect: * Restart your computer to apply the enforcement. * Alternatively, you can open an administrative Command Prompt and run net stop workstation /y followed by net start workstation to restart the client service immediately (note that this may temporarily drop active network connections).

Once configured, your system will reject any outbound SMB connections to servers that do not support or allow packet signing.