SMB signing should be enabled on all domain controllers

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Domain controllers · All checks

Run this check

Invoke-Maester -TestId AD-DC-04

Overview

SMB signing (also known as security signatures) is a security feature that helps prevent:

• Man-in-the-middle attacks: Attackers cannot modify SMB packets in transit
• Session hijacking: Ensures the integrity of SMB sessions
• Replay attacks: Prevents attackers from replaying captured SMB traffic

Without SMB signing, an attacker on the network could intercept and modify SMB traffic between clients and domain controllers.

Control Type

Preventive

Security Recommendation

Enable SMB signing on all domain controllers.

To enable SMB signing:

#### Check current status
Get-SmbServerConfiguration | Select-Object EnableSecuritySignature, RequireSecuritySignature

#### Enable SMB signing
Set-SmbServerConfiguration -EnableSecuritySignature $true -RequireSecuritySignature $true -Force

You can also enforce SMB signing through Group Policy:

• Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options
• “Microsoft network server: Digitally sign communications (always)” = Enabled

How the Test Works

This test queries the SMB server configuration on each domain controller to check if SMB signing is enabled and required. It reports:

• Number of DCs with signing enabled
• Number of DCs with signing required
• Names of DCs without signing enabled

Related Tests

• Test-MtAdDcSmbv1EnabledCount - SMBv1 protocol status
• Test-MtAdDcSmbv311EnabledCount - SMBv3.1.1 protocol status

Details

Every attribute of this check

Field	Value
Test ID	AD-DC-04
Severity	High
Suite	Active Directory
Product	Active Directory
Feature	Domain controllers
Area	Infrastructure hardening
Resource type	DomainController
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1557 Adversary-in-the-Middle
Supports controls	nist-800-53-r5:SC-8
PowerShell test	Test-MtAdDcSmbSigningEnabledCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Remoting:Microsoft.PowerShell, ActiveDirectory:Cim:root\Microsoft\Windows\SMB:MSFT_SmbServerConfiguration:Read

Source

• Test: tests/ad/domain-controller/Test.AD-DC-04.ps1
• Documentation: tests/ad/domain-controller/Test.AD-DC-04.md