Enforce SMB Encryption on Windows via Regedit

This guide provides a step-by-step walkthrough on how to enforce Server Message Block (SMB) packet encryption on Windows clients using the Registry Editor (Regedit). Enforcing SMB encryption ensures that all data transferred across your network via SMB 3.0 and newer is protected against eavesdropping and man-in-the-middle attacks, securing network communication between the client and remote file shares.

Prerequisites

• Windows 8 / Windows Server 2012 or later (SMB 3.0+ support).
• Administrative privileges on the target machine.

Step-by-Step Configuration via Registry Editor

Step 1: Open the Registry Editor

1. Press Windows Key + R to open the Run dialog.
2. Type regedit and press Enter.
3. Select Yes if prompted by User Account Control (UAC).

Step 2: Navigate to the SMB Client Parameters Key

In the Registry Editor address bar, paste the following path and press Enter:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters

Step 3: Create or Modify the RequireEncryption Value

1. In the right-hand pane, check if a DWORD value named RequireEncryption exists.
2. If it does not exist:
   • Right-click an empty area in the right pane.
   • Select New > DWORD (32-bit) Value.
   • Name the value RequireEncryption.
3. Double-click RequireEncryption.
4. Set the Value data field to 1.
5. Ensure the Base is set to Hexadecimal, then click OK.

(Note: Setting RequireEncryption to 1 forces the SMB client to reject unencrypted connections from SMB servers.)

Optional: Enforce SMB Encryption on Local Shares (Server-Side)

If the system also hosts SMB shares and you want incoming connections encrypted:

1. Navigate to:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

2. Create or modify a DWORD (32-bit) value named EncryptData.

3. Set the Value data to 1 and click OK.

Step 4: Apply the Changes

To apply the registry modifications, restart the SMB workstation service or reboot the machine:

1. Open PowerShell or Command Prompt as Administrator.

2. Run the following commands to restart the SMB client service:

   net stop lanmanworkstation /y
   net start lanmanworkstation

   (Alternatively, restart your computer to ensure all dependent network components load the new configuration.)

Verification

To verify that SMB encryption is enforced, open PowerShell as an Administrator and execute:

Get-SmbClientConfiguration | Select-Object EnableSecuritySignature, RequireSecuritySignature, RequireEncryption

The output should show RequireEncryption : True. Subsequent connections to SMB shares that do not support SMB 3.x encryption will be blocked.