SMB Signing: What It Is and How to Enforce It

Written by Ruben Selby, Founder and Lead Security Consultant, Wolfcore. Last reviewed 10 November 2026.

Part of the Wolfcore Resources library: Ports, protocols and services.

In one sentence: SMB signing is a setting that makes Windows file sharing prove each message came from the right machine and was not altered, which stops an attacker on your network passing off someone else’s login as their own.

What SMB signing does

SMB is the protocol Windows uses for file shares and printers, normally on port 445. Signing is a feature inside it, not a separate port. Microsoft explains that SMB signing uses the session key and cipher suite to add a signature to each message, containing a hash of the entire message in the SMB header. If someone tampers with a message, the hash no longer matches. The hash also covers the identities of the sender and recipient.

Signing can be required for outbound traffic (the client), inbound traffic (the server), both or neither. Microsoft lists the defaults: Windows 11 24H2 Enterprise, Pro and Education require both outbound and inbound signing, Windows Server 2025 requires outbound only, and 24H2 Home requires neither. Older systems and many third-party devices may not require it.

Why attackers look for it

Signing is checked from inside the network, so attackers look for servers that do not require it. Once an attacker is on your network, for example through one infected laptop or a guest on Wi-Fi, they can scan for file servers and check which ones accept unsigned sessions. This is a step after the first break-in, used to spread.

How it gets attacked

The technique is named in MITRE ATT&CK T1557.001, Name Resolution Poisoning and SMB Relay.

A staff PC asks the network for a computer by name, and the normal lookup fails.
Windows falls back to broadcast-style lookups (LLMNR and NetBIOS name service). MITRE describes how adversaries can spoof an authoritative source by responding to this traffic, forcing communication with an adversary-controlled system.
The PC sends its username and a hashed login response to the attacker.
MITRE notes that these hashes can be intercepted and relayed to access and execute code against a target system, or cracked offline.
If the target does not require signing, the relayed login is accepted.

Missing signing is a configuration weakness, not a software bug, so there is no single CVE. Microsoft also warns that signing is more effective when you use Kerberos instead of NTLMv2 and do not connect to shares using IP addresses.

Who it affects and how badly

Sole trader to 10 staff: often one flat network and a NAS. Worst case: one compromised PC leads to the shared drive being read or encrypted.
10 to 250 staff (manufacturing, construction, accountancy): Windows domains with older servers and scanners. Worst case: an attacker moves from a laptop to a server and then to domain control, with downtime across the site.
Regulated firms and councils: file servers hold personal data. Worst case: a reportable breach and weeks of recovery.

What we check on a test

Which hosts on the in-scope network answer on 445 and whether each requires signing.
Whether name-lookup fallbacks (LLMNR, NetBIOS name service) are still enabled on user machines.
Whether NTLM is still in use where Kerberos would work.
Whether printers, scanners and NAS devices are the reason signing was relaxed.

The UK angle

Cyber Essentials does not name SMB signing. Its requirements do say firewalls must block unauthenticated inbound connections by default, and that default or unnecessary services should be removed under secure configuration. Port 445 should never face the internet. Signing is the inside-the-network layer on top of that.

Diagram

Worked example (illustration, not a real case)

A 30-person construction firm runs an old Windows file server and a scanner that cannot sign, so signing was switched off years ago. A contractor plugs an infected laptop into the office network. It answers a mistyped share name, collects a login and relays it to the file server. Project drawings are copied out. Cost: days of disruption and a call to the client. The fix: replace or isolate the scanner, require signing on the server, and turn off LLMNR.

How to check whether yours is exposed

On a Windows machine, run the PowerShell commands Microsoft documents: Get-SmbServerConfiguration and Get-SmbClientConfiguration, looking at RequireSecuritySignature.
Confirm port 445 is blocked at the internet edge in your firewall rules.
List devices that cannot sign, such as old NAS boxes and scanners.
Use the free web vulnerability scan for your internet-facing view.

How to secure it

Require signing on servers and clients. Microsoft’s route is the Group Policy setting “Microsoft network client: Digitally sign communications (always)” or Set-SmbServerConfiguration -RequireSecuritySignature $true.
Block 445 at the perimeter.
Use Kerberos rather than NTLM where possible.
Disable LLMNR and NetBIOS name service in Group Policy if not needed, as MITRE recommends.
Replace devices that cannot sign, rather than disabling signing. Microsoft does not recommend disabling it as a workaround for third-party servers.
Segment the network so one infected PC cannot reach every server.

FAQ

Is SMB signing on by default? On Windows 11 24H2 Enterprise, Pro and Education, yes. Other systems vary.

Does signing encrypt my files? No. It proves who sent a message and that it was not altered. That is integrity, not secrecy.

What breaks if I require it? Third-party servers that cannot sign, and guest access to shares.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan or see penetration testing.

SMB signing: what it is, how it is attacked and how to secure it