SMB signing on Windows 11 24H2: what changes and what breaks

SMB signing adds a signature to each SMB message so tampering and relay attacks are detected. Windows 11 24H2 Enterprise, Pro and Education require it for both outbound and inbound connections. Connections to servers that do not support signing can fail, and the right fix is on the server, not turning signing off.

What SMB signing does

Server Message Block signing uses the session key and cipher suite to add a signature to messages. The signature holds a hash of the whole message in the SMB header, and it includes the identities of the original sender and intended recipient. If someone changes a message in transit, the hash no longer matches. Microsoft describes this as protection against relay and spoofing attacks, and as providing authentication by verifying the identity of server and client, which helps prevent adversary in the middle attacks.

What 24H2 changed

Per Microsoft's page, the requirement depends on the product:

• Windows 11, version 24H2 Enterprise, Pro and Education: outbound and inbound signing required.
• Windows Server 2025: outbound signing required only.
• Windows 11, version 24H2 Home: neither required.

Outbound covers traffic from the SMB client. Inbound covers traffic to the server.

What breaks

All Windows versions support signing, but a third party server might disable it or not support it. Then connecting to a share can fail with errors such as STATUS_INVALID_SIGNATURE and the message that the cryptographic signature is invalid.

A second case involves guest access. Requiring signing also disables guest access to shares. Devices such as older NAS boxes and printers that rely on guest accounts may produce messages saying your organization's security policies block unauthenticated guest access.

Microsoft states that it does not recommend disabling SMB signing as a workaround for third party servers, and does not recommend signing with guest accounts.

How to check your state

Run these in PowerShell to see whether signing is required on the client and the server:

Get-SmbClientConfiguration | FL RequireSecuritySignature
Get-SmbServerConfiguration | FL RequireSecuritySignature

True means required. You can also set it with Set-SmbClientConfiguration and Set-SmbServerConfiguration, or through the Group Policy setting Microsoft network client: Digitally sign communications (always).

Make signing effective

Microsoft lists three habits so that signatures are effective:

• Use Kerberos instead of NTLMv2.
• Do not connect to shares using IP addresses.
• Do not use CNAME DNS records. Assign alternate computer names with netdom.exe instead.

These are the same habits that keep authentication on Kerberos and off its NTLM fallback.

A fix order for a failing share

1. Identify the server and its vendor. Is it a NAS, a printer, a scanner, or an old Windows host?
2. Check for a firmware or software update that adds signing support, and enable signing on the server.
3. Stop using guest access. Create a real account for the device and share.
4. If the device cannot be fixed, plan its replacement and isolate it on a restricted network segment until then.
5. Only as a last, documented exception, relax the client setting for a tightly scoped group, with an expiry date.

Resist the urge to turn signing off fleet wide because one scanner complains. Relaying attacks are a real way to turn a foothold into domain access, and signing is one of the controls that counters them.

Checks for developers

Build servers and test labs often mount shares from odd devices. If a CI runner stops reaching an artifact share after an OS upgrade, check signing before you check the network. The error text is usually a hint.

Quick check

Sources

• Control SMB signing behavior, Microsoft Learn

Last reviewed: 19 October 2026.