Audit server does not support signing
The `AuditServerDoesNotSupportSigning` DWORD value enables SMB-client auditing for servers that do not support SMB signing.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows\LanmanWorkstation\AuditServerDoesNotSupportSigning
The AuditServerDoesNotSupportSigning DWORD value enables SMB-client auditing for servers that do not support SMB signing. When the value is 1, the Windows SMB client records an audit event after detecting such a server. These events are written to the Microsoft-Windows-SMBClient/Audit log.
This telemetry can identify incompatible or outdated SMB servers, including systems that could prevent an organization from requiring signing on outbound SMB connections. The setting examines server capabilities from the client side; it is distinct from the Lanman Server policy that audits SMB clients.
Notes
Security
SMB signing provides message integrity and helps protect SMB traffic against tampering, relay, and spoofing attacks. An audit event can therefore identify a server for which that protection is unavailable.
This value only enables auditing. It does not enable or require SMB signing, reject a connection, or change permissions on SMB shares. Whether an unsigned connection is permitted remains subject to the separate signing requirements of the SMB client and server.
Notes
Microsoft defines 1 as enabled and 0 as disabled, with 0 documented as the default. This is a computer-scoped policy backed by LanmanWorkstation.admx.
Client-side SMB signing auditing is documented for Windows 11, version 24H2 and later. Microsoft also documents SMB signing auditing as a Windows Server 2025 feature.
Microsoft documentation
Microsoft Learn: Policy CSP – LanmanWorkstation
Microsoft Learn: Overview of Server Message Block signing in Windows