Glossary
SMB signing
Cryptographic signing of SMB packets that prevents tampering and blocks NTLM relay to SMB servers.
SMB signing adds a cryptographic signature, derived from the session key, to each SMB message. The receiver verifies it, so messages cannot be modified in transit and an attacker who relays someone else's authentication cannot use the resulting session, because they don't have the session key.
It is controlled separately for the client and server side through the Microsoft network client/server: Digitally sign communications (always) policies, or Set-SmbClientConfiguration and Set-SmbServerConfiguration -RequireSecuritySignature $true. Domain controllers have long required it; Windows 11 24H2 (Enterprise, Pro and Education) requires it by default for inbound and outbound connections, and Windows Server 2025 for outbound connections. SMB 3 encryption goes further by encrypting the traffic.