Enforce SMB Signing for Outgoing Connections in Regedit

Server Message Block (SMB) signing protects network traffic against tampering and relay attacks by verifying packet authenticity. Configuring strict SMB signing on outgoing connections ensures your Windows client will only communicate with servers that also support and require SMB signing, dropping any unsigned sessions. This article details the exact registry keys and steps required to enforce strict SMB signing across all outgoing connections using the Windows Registry Editor (regedit).

Registry Configuration Details

To enforce SMB signing for outgoing connections, you must configure the SMB Client (LanmanWorkstation) parameters:

(Optional but recommended) Ensure the companion value EnableSecuritySignature is also present: * Value Name: EnableSecuritySignature * Value Type: REG_DWORD * Value Data: 1

Step-by-Step Instructions

  1. Open the Registry Editor:
    • Press Win + R, type regedit, and press Enter.
    • Click Yes if prompted by User Account Control (UAC).
  2. Navigate to the Target Key:

    • In the address bar, paste the following path and press Enter:

      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
  3. Modify or Create RequireSecuritySignature:
    • Look for the RequireSecuritySignature DWORD entry in the right pane.
    • If it exists, double-click it, set the Value data to 1, ensure the Base is set to Hexadecimal, and click OK.
    • If it does not exist:
      1. Right-click an empty space in the right pane.
      2. Select New > DWORD (32-bit) Value.
      3. Name the value RequireSecuritySignature.
      4. Double-click it, set the Value data to 1, and click OK.
  4. Verify EnableSecuritySignature:
    • Locate EnableSecuritySignature in the same key.
    • Ensure its value is also set to 1. If missing, create it as a DWORD (32-bit) Value and assign it data 1.
  5. Apply Changes:

    • Close the Registry Editor.

    • Restart the computer or restart the Workstation service via PowerShell/Command Prompt:

      net stop lanmanworkstation /y
net start lanmanworkstation

Quick Enforcement via Command Line

Alternatively, you can apply these registry values instantly by opening an elevated Command Prompt or PowerShell terminal and executing:

reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v RequireSecuritySignature /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v EnableSecuritySignature /t REG_DWORD /d 1 /f

Once applied, the machine will refuse to establish outgoing SMB sessions with any remote server that does not support or actively employ SMB signing.