Audit server does not support encryption
Setting this `REG_DWORD` value to `1` enables an SMB client audit event when a contacted SMB server does not support SMB encryption.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows\LanmanWorkstation\AuditServerDoesNotSupportEncryption
Setting this REG_DWORD value to 1 enables an SMB client audit event when a contacted SMB server does not support SMB encryption.
Windows records the events in Applications and Services Logs\Microsoft\Windows\SMBClient\Audit. Microsoft associates event IDs 31998 and 31999 with the client-side auditing of SMB encryption and signing support.
Notes
Security
This value provides detection and logging only. It does not enable SMB encryption, require encrypted connections, or stop the SMB client from connecting to a server that lacks encryption support. Consequently, the setting does not directly protect SMB traffic.
The audit information can identify servers or third-party SMB implementations that would be incompatible with an SMB encryption requirement. It reports server capability rather than the protection applied to each session: the absence of an audit event does not establish that a particular SMB connection was encrypted.
Notes
This is a device-scoped setting for outbound SMB client connections. Microsoft documents 0 as the disabled default and 1 as enabled.
Client auditing for SMB encryption and signing support is available beginning with Windows 11, version 24H2, and Windows Server 2025. The Policy CSP reference lists Windows 11, version 24H2, build 10.0.26100.3613 or later as the applicable client version.
Microsoft documentation
Microsoft Learn: LanmanWorkstation Policy CSP — AuditServerDoesNotSupportEncryption
Microsoft Learn: Overview of Server Message Block signing in Windows