Mandate the maximum version of SMB
This registry value limits the highest SMB 2 or SMB 3 dialect that the Windows SMB client may negotiate for outbound connections.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows\LanmanWorkstation\MaxSmb2Dialect
This registry value limits the highest SMB 2 or SMB 3 dialect that the Windows SMB client may negotiate for outbound connections. The DWORD value data 785 represents SMB 3.1.1 (0x00000311).
When a connection is established, the client and server negotiate the highest dialect supported by both peers and permitted by the effective minimum and maximum boundaries. A value of 785 makes SMB 3.1.1 the highest available dialect; it does not require every connection to use SMB 3.1.1. A lower permitted dialect can still be negotiated when the remote server does not support SMB 3.1.1.
Notes
Security
SMB 3.1.1 supports preauthentication integrity, which helps protect dialect negotiation and authentication messages against tampering. This protection applies only when the connection actually negotiates SMB 3.1.1.
Setting the maximum to SMB 3.1.1 does not by itself exclude older SMB 2 or SMB 3 dialects. Connections are restricted to SMB 3.1.1 only when the effective minimum is also SMB 3.1.1. This policy also does not prevent SMB 1 from being used if that separate Windows component remains installed and enabled.
Notes
The policy applies to the SMB client and therefore governs outbound SMB connections. It does not control the dialects accepted by the local SMB server for inbound connections.
Microsoft documents the corresponding policy control for Windows 11, version 24H2, and Windows Server 2025.
Microsoft documentation
Microsoft Learn: LanmanWorkstation Policy CSP
Microsoft Learn: Manage SMB dialects in Windows and Windows Server 2025