Enforce SMB Server Signing Using Regedit

This guide explains how to configure Windows to enforce SMB packet signing for all incoming connection requests using the Registry Editor (Regedit). Enforcing SMB signing on the server side ensures that incoming network traffic is authenticated and protected against tampering, effectively mitigating man-in-the-middle (MitM) and relay attacks on your network.

Prerequisites

• Administrative privileges on the target Windows system.
• Standard access to the Windows Registry Editor.

Step 1: Open the Registry Editor

1. Press Windows Key + R to open the Run dialog box.
2. Type regedit and press Enter or click OK.
3. If prompted by User Account Control (UAC), click Yes to allow access.

Step 2: Navigate to the LanmanServer Parameters Key

In the Registry Editor address bar, paste the following path and press Enter:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

Step 3: Configure SMB Server Signing Values

To strictly enforce SMB signing for all incoming requests, two DWORD values must be configured within the Parameters key:

1. EnableSecuritySignature:
   • Locate the value named EnableSecuritySignature. If it does not exist, right-click an empty area in the right pane, select New > DWORD (32-bit) Value, and name it EnableSecuritySignature.
   • Double-click EnableSecuritySignature, set the Value data to 1, and click OK.
2. RequireSecuritySignature:
   • Locate the value named RequireSecuritySignature. If it does not exist, right-click an empty area, select New > DWORD (32-bit) Value, and name it RequireSecuritySignature.
   • Double-click RequireSecuritySignature, set the Value data to 1, and click OK.

Step 4: Apply the Changes

For the changes to take effect, restart the SMB Server service or reboot the computer.

To restart the service via Command Prompt (Admin):

net stop lanmanserver /y
net start lanmanserver

Alternatively, restart the operating system. Once restarted, the system will reject any incoming SMB connections from clients that do not support or enable SMB packet signing.