UCF STIG Viewer Logo

The Windows SMB server must be configured to always perform SMB packet signing.


Overview

Finding ID Version Rule ID IA Controls Severity
V-6833 WN12-SO-000032 SV-52936r2_rule Medium
Description
The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB server will only communicate with an SMB client that performs SMB packet signing.
STIG Date
Windows Server 2012 / 2012 R2 Member Server Security Technical Implementation Guide 2016-12-19

Details

Check Text ( C-47241r2_chk )
If the following registry value does not exist or is not configured as specified, this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \System\CurrentControlSet\Services\LanManServer\Parameters\

Value Name: RequireSecuritySignature

Value Type: REG_DWORD
Value: 1
Fix Text (F-45862r1_fix)
Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> "Microsoft network server: Digitally sign communications (always)" to "Enabled".