The Server Message Block (SMB) protocol is used to provide file and print sharing in a Microsoft based network. To help detect man in the middle (MITM) attacks that may modify SMB traffic in transit, we can configure SMB signing via group policy. By digitally signing SMB packets the client and server can confirm where they originated from as well as their authenticity.

SMB packet signing is available in all supported versions of Windows. Microsoft also note that depending on factors such as the SMB version, file sizes, and specific hardware in use, SMB packet signing can degrade the performance of SMB, which is to be expected as we’re signing every packet that goes across the network, which adds overhead.

Read more »

SMB 3.1.1 was added with Windows Server 2016 and Windows 10 operating systems. This post will cover the SMB 3.1.1 protocol security features that have been introduced, outlining why you would want to use them.

Read more »

By default SMB version 1.0 is enabled in Windows Server 2016. As this was last needed in Windows XP and Windows Server 2003 it’s quite old, newer versions of SMB are more secure and have additional features. If you no longer need to support these older versions of SMB file shares, it’s a good idea to disable SMB version 1.0, or even remove it completely, as a number of recent vulnerabilities specifically affect SMB version 1.

Read more »

By default data transferred over the network to an SMB share is in plain text, meaning that an attacker with access to the network can view the files being transferred. By enabling SMB encryption on SMB shares this can be prevented.

When creating an SMB share either with PowerShell or through the graphical user interface (GUI) we have the option to enable SMB encryption on the share. We’ll be showing you how to enable SMB encryption on an existing SMB file share in these examples using both PowerShell and the GUI in Windows Server 2016.

Read more »