Microsoft network client: Digitally sign communications (always)
The `RequireSecuritySignature` registry value controls the SMB client's signing requirement for outbound SMB connections.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters\RequireSecuritySignature
The RequireSecuritySignature registry value controls the SMB client's signing requirement for outbound SMB connections. Its data type is REG_DWORD. A value of 1 requires the client to use signed communication with the SMB server. The connection fails if the server does not support SMB signing.
In a signed session, every SMB message carries a cryptographic signature derived using the session key and validated by the recipient. This allows changes to messages in transit to be detected.
This value affects the computer's SMB client. It does not require the local SMB server to sign inbound connections.
Notes
Security
Requiring SMB signing protects the integrity of SMB messages and helps prevent tampering, relay, and spoofing attacks. The signatures bind messages to the authenticated session and confirm the identities of the sender and intended recipient.
SMB signing does not encrypt the message contents and therefore does not provide confidentiality against network eavesdropping. It also does not change share permissions, file permissions, or the underlying user authentication requirements.
Possible side effects
Connections to older or third-party SMB servers can fail when those servers do not support SMB signing. Insecure guest access is incompatible with required SMB signing because guest sessions do not support SMB signatures.
Generating and validating signatures consumes additional processor resources. Systems with high SMB throughput or fast network connections can experience reduced transfer performance.
Notes
For SMB 2.02 and later, RequireSecuritySignature determines whether signing is required. The similarly named EnableSecuritySignature value does not have the same effect for SMB 2 and SMB 3 and is ignored by those protocol versions.
A value of 1 makes signing mandatory from the client's perspective. A value of 0 only means that the client does not require it; a connection can still be signed when the server requires signing.
Microsoft documentation
Microsoft Learn: What is Server Message Block signing?
Microsoft Learn: Microsoft network client: Digitally sign communications (always)