SMB Signing

Joshua Thompson 156 Reputation points
2021-07-29T17:04:51.643+00:00

I have the below policies pushed out on the Default Domain Policy for my organization.
Computer > Policies > Windows Settings > Security> Local Policies > Security Options > Microsoft network server: Digitally sign communications (always)
Computer > Policies > Windows Settings > Security> Local Policies > Security Options > Microsoft network client: Digitally sign communications (always)

If I run an RSOP on the various server I can verify the policy settings are in place.

When I run 'Get-SMBConnection' on various servers I can see SMB Connections.
When I run 'Get-SMBConnection | fl signed' I see some of these connections shows 'signed: True' and some show 'signed: False'.

Servers are all Win 2016 / 2019

If the policy is pushed out via the default domain policy why arent all the connections showing 'signed: True'?

What am I missing?

Windows
Windows
A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.
4,788 questions
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,201 questions
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. AsterWei-MSFT 1 Reputation point
    2021-07-30T08:30:38.677+00:00

    Hello @Joshua Thompson ,

    Thank you for posting here.

    From the link below, we can see the function of the following two commands is:
    Get connections from an SMB client to SMB servers.

    Get-SmbConnection
    'Get-SMBConnection | fl signed'

    Get-SmbConnection
    https://learn.microsoft.com/en-us/powershell/module/smbshare/get-smbconnection?view=windowsserver2019-ps

    Please troubleshot as below:
    1.Force entire AD replication by running command repadmin /syncall /AdeP on one DC.

    2.Wait about ten minutes, run gpupdate /force on machine showing 'signed: False'.

    3.Please check the gpresult report on machine showing 'signed: False'.

    Logon the machine using domain Administrator.
    Open CMD (run as Administrator).
    Type gpresult /h C:\gpo.html and click Enter.
    Open gpo.html and check if the following two settings are enabled under “Computer Details”.

    Computer > Policies > Windows Settings > Security> Local Policies > Security Options > Microsoft network server: Digitally sign communications (always)==>Enabled
    Computer > Policies > Windows Settings > Security> Local Policies > Security Options > Microsoft network client: Digitally sign communications (always)==>Enabled

    If all above is OK, please access the shared folder on machine showing 'signed: False'.

    Then check the SMB connection again using the commands below.

    Get-SmbConnection
    'Get-SMBConnection | fl signed'

    Hope the information above is helpful to you.

    Should you have any question or concern, please feel free to let us know.

    Best Regards,
    Aster Wei

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.

    0 comments
  2. Joshua Thompson 156 Reputation points
    2021-08-02T16:07:27.373+00:00

    I ran a test and the 'Get-SMBConnection | fl signed' did not come back with all connections showing as TRUE until the server was restarted.
    I will restart other servers tonight and confirm if this was a one time occurrence or if this restart fixed the problem.
    '
    Thank you,

    0 comments
  3. Joshua Thompson 156 Reputation points
    2021-08-03T13:19:00.843+00:00

    No restart needed. Just patience :)
    After checking again, all connections on ALL my servers are coming back with SMB signed TRUE except for 1 connection.

    0 comments