Audit client does not support encryption
A `DWORD` value of `1` enables server-side auditing of SMB clients that do not support SMB encryption.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows\LanmanServer\AuditClientDoesNotSupportEncryption
A DWORD value of 1 enables server-side auditing of SMB clients that do not support SMB encryption. When the SMB server detects such a client, it records an audit event in the Microsoft\Windows\SMBServer\Audit log.
This setting helps identify older or non-Microsoft SMB implementations that lack encryption support, particularly when assessing compatibility before making SMB encryption mandatory.
Notes
Security
The setting provides visibility into clients with which SMB-provided encryption cannot be used. These clients can present a security concern if sensitive data is transferred over unencrypted SMB connections.
This value enables logging only. It does not require SMB encryption, encrypt network traffic, or reject incompatible clients. An audit event reports a lack of encryption support; by itself, it does not demonstrate that data was exposed or that an attack occurred.
Notes
The policy is defined by LanmanServer.admx and applies to the local SMB server, not to outbound connections made by the SMB client. Microsoft lists SMB signing and encryption auditing as available in Windows Server 2025 and Windows 11, version 24H2.
Microsoft documentation
Microsoft Learn: LanmanServer Policy CSP – AuditClientDoesNotSupportEncryption
Microsoft Learn: SMB signing and encryption auditing