Enable authentication rate limiter

Purpose

Show registry keys (1)

• HKLM\Software\Policies\Microsoft\Windows\LanmanServer\EnableAuthRateLimiter

A DWORD value of 1 enables the Windows SMB server authentication rate limiter. The limiter introduces a delay after failed NTLM- and PKU2U-based authentication attempts, reducing the number of passwords that can be tried through SMB within a given period.

EnableAuthRateLimiter does not itself define the length of the delay. The delay is controlled by a separate SMB server setting, for which Microsoft documents a default of 2000 milliseconds.

Notes

Security

The delay makes brute-force attacks against accounts reachable through SMB substantially more time-consuming. It does not completely prevent authentication attempts, lock accounts, or block SMB connections. Microsoft therefore describes the feature as a defense-in-depth measure.

The rate limiter covers failed NTLM- and PKU2U-based authentication attempts. It does not affect normal Kerberos authentication because Kerberos authentication occurs before an application protocol such as SMB establishes its connection. This registry value also provides no protection for authentication through other network services.

Possible side effects

Legitimate failed NTLM- or PKU2U-based authentication attempts against the SMB server are subject to the same delay. Repeated attempts using incorrect or outdated credentials can therefore receive slower responses.

Notes

This is a computer-scoped policy value of type REG_DWORD; 1 means enabled and 0 means disabled.

Microsoft documents the SMB authentication rate limiter for Windows Server 2025 and Windows 11, version 24H2 or later. The feature is enabled by default on these operating systems. Its protection is relevant only when the SMB server is reachable over the network.

Microsoft documentation

Microsoft Learn: LanmanServer Policy CSP – EnableAuthRateLimiter

Microsoft Learn: Configure SMB authentication rate limiter for Windows

See also

• Entry in the reference