Mandate the maximum version of SMB
This registry value defines the highest SMB dialect that the SMB server may negotiate for inbound connections.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows\LanmanServer\MaxSmb2Dialect
This registry value defines the highest SMB dialect that the SMB server may negotiate for inbound connections. It is a DWORD value, and value data 785 represents SMB 3.1.1.
The client and server negotiate the highest dialect supported by both endpoints and permitted by their respective minimum and maximum limits. With SMB 3.1.1 as the upper limit, the server can use SMB 3.1.1 when the client also supports it. The value does not require SMB 3.1.1: lower SMB 2 and SMB 3 dialects remain available unless they are excluded by a separate minimum-dialect setting.
Notes
Security
When a connection actually negotiates SMB 3.1.1, it uses that dialect's preauthentication integrity protection. This protects the early negotiation and session-establishment process against tampering.
Setting the maximum to 785 does not ensure that every connection uses SMB 3.1.1. It does not exclude older mutually supported dialects, require SMB encryption, or establish a minimum SMB version. The setting also does not prevent SMB 1 from being used if that component remains installed and enabled.
Notes
SMB server dialect control for inbound connections is supported beginning with Windows 11, version 24H2, and Windows Server 2025. This server setting is distinct from the corresponding SMB client setting and from the server's minimum-dialect setting.
Microsoft documentation
Microsoft Learn: Policy CSP – LanmanServer – MaxSmb2Dialect
Microsoft Learn: Manage SMB dialects in Windows and Windows Server 2025
Microsoft Learn: Protect SMB traffic from interception