Audit client does not support signing
This registry value controls auditing for SMB clients that do not support SMB signing.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows\LanmanServer\AuditClientDoesNotSupportSigning
This registry value controls auditing for SMB clients that do not support SMB signing. A value of 1 causes the SMB server to log an audit event when it detects such a client. With a value of 0, or when the value is absent, this specific event is not logged.
The events are recorded in the Microsoft-Windows-SMBServer/Audit log. They can help identify incompatible or outdated clients and devices.
Notes
Security
This setting does not require SMB signing and does not block connections. It changes neither signing negotiation nor permissions for SMB shares. Its security function is limited to making the absence of signing support visible through audit events.
SMB signing provides message integrity and helps protect SMB communication against tampering, relay, and spoofing attacks. An event therefore identifies a client whose lack of signing support may require security review. The event alone does not demonstrate that an attack occurred or that the associated connection was permitted to operate without signing.
Notes
This is a computer-scoped setting that applies to the device's SMB server component. It is distinct from the corresponding Lanman Workstation setting, which audits SMB servers lacking signing support from the client side.
SMB signing and encryption auditing is also documented for Windows Server 2025.
Microsoft documentation
Microsoft Learn: Policy CSP – LanmanServer
Microsoft Learn: Overview of Server Message Block signing in Windows