Require Encryption
This `DWORD` value controls whether the SMB client requires encryption for all outbound SMB connections.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows\LanmanWorkstation\RequireEncryption
This DWORD value controls whether the SMB client requires encryption for all outbound SMB connections. A value of 0 disables that client-wide requirement. A destination server therefore does not have to support SMB encryption solely because of this setting.
A value of 0 does not prohibit SMB encryption. A connection can still be encrypted or require encryption through settings associated with the destination server, share, UNC path, or mapped drive. SMB encryption requires SMB 3.0 or later.
Notes
Additional effects
Without the blanket encryption requirement, the client can potentially connect to legacy or third-party SMB servers that do not support SMB encryption. Separate requirements concerning the SMB dialect, authentication, or SMB signing remain effective and can still prevent a connection.
Security
A value of 0 does not guarantee encryption for every SMB connection. If no other applicable setting requires encryption, SMB data can be transmitted without the confidentiality protection provided by SMB encryption. An attacker in a position to observe the network traffic could therefore potentially read that data.
This value does not automatically disable SMB signing. A signed but unencrypted connection can provide tamper protection, but it does not prevent the contents from being observed.
Notes
This is a device-level policy. Microsoft documents the client-wide encryption requirement for Windows 11, version 24H2, and Windows Server 2025 or later. The Policy CSP reference identifies 0 as the disabled default and 1 as enabled.
Microsoft documentation
Microsoft Learn: Configure the SMB client to require encryption in Windows
Microsoft Learn: Policy CSP – LanmanWorkstation – RequireEncryption