Set authentication rate limiter delay (milliseconds)
This value specifies the delay that the Windows SMB server applies after a failed NTLM- or PKU2U-based authentication attempt.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows\LanmanServer\InvalidAuthenticationDelayTimeInMs
This value specifies the delay that the Windows SMB server applies after a failed NTLM- or PKU2U-based authentication attempt. It is a DWORD value expressed in milliseconds.
A value of 2000 introduces a two-second delay between failed authentication attempts. Successful authentication and ordinary SMB data transfers are not rate-limited by this delay.
Notes
Security
The delay makes brute-force and password-spraying attacks against the SMB server more costly by preventing an attacker from testing large numbers of credentials in rapid succession. It provides defense in depth and does not replace account lockout policies or monitoring of failed sign-ins.
The rate limiter applies to failed NTLM- and PKU2U-based authentication attempts. It does not delay Kerberos authentication, which takes place before an application protocol such as SMB establishes its connection.
Possible side effects
Legitimate failed SMB authentication attempts, such as attempts made with an incorrect or outdated password, are also subject to the configured delay. Repeated failures can therefore take longer to process.
Notes
The SMB authentication rate limiter is supported beginning with Windows Server 2025 and Windows 11, version 24H2. Microsoft documents an allowed delay range of 0 through 10000 milliseconds in multiples of 100. The documented default is 2000.
The delay is effective only while the SMB authentication rate limiter is active. Its activation is also governed by the separate EnableAuthRateLimiter setting. A delay value of 0 disables the rate limiter.
Microsoft documentation
Microsoft Learn: Configure SMB authentication rate limiter for Windows
Microsoft Learn: Policy CSP – LanmanServer