Microsoft network server: Digitally sign communications (always)
The `RequireSecuritySignature` DWORD value controls the signing requirement of the SMB server component.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\RequireSecuritySignature
The RequireSecuritySignature DWORD value controls the signing requirement of the SMB server component. A value of 1 requires SMB signing for incoming connections. The server continues a connection only when the client supports signing and valid SMB message signatures can be exchanged.
For SMB 2.02 and later, every message in a signed session carries a cryptographic signature derived from the session key. The recipient can use that signature to detect changes made in transit and verify that the message belongs to the expected sender and recipient.
SMB signing protects message integrity and authenticity. It does not encrypt message contents or alter share and NTFS permissions.
Notes
Security
Requiring signatures helps protect SMB connections against message tampering, relay, spoofing, and session-hijacking attacks. Messages with missing or invalid signatures aren't accepted as valid parts of the session.
The protection still depends on the security of the negotiated session key and authentication method. This value doesn't replace SMB encryption and doesn't prevent an observer from reading unencrypted payload data.
Possible side effects
SMB clients and third-party devices that don't support SMB signing can't connect to the server. This can affect older systems, network-attached storage devices, and embedded SMB implementations.
Unauthenticated guest access is incompatible with required SMB signing and is rejected. Generating and validating signatures also adds processing overhead. The performance impact is often limited on modern systems but can become more noticeable with high-speed networks and storage.
Notes
RequireSecuritySignature under LanmanServer applies to the SMB server component and therefore to incoming connections. The requirement for outgoing SMB client connections is controlled by the value of the same name under LanmanWorkstation.
For SMB 2.02 and later, RequireSecuritySignature determines whether signing is mandatory. It is distinct from the similarly named EnableSecuritySignature value, which Microsoft states affects only SMB 1.
Microsoft documentation
Microsoft Learn: What is Server Message Block signing?
Microsoft Learn: Control SMB signing behavior