Now let's go ahead and configure SMB signing for some additional security.
SMB signing is beneficial to help detect men in the middle attacks.
By digitally signing the SMB packets.
The client and server can confirm where they originated from as well as the authenticity.
In order to configure SMB signing, there are four policy items which we will need to define within
route policy.
Let's begin with SMB server packet signing.
You will navigate to computer configuration policies, windows settings, security settings, local
policies, and security options.
You will scroll down and select the option.
Microsoft Network Server Digitally sign communications and we will look at the always setting.
This option controls whether the server providing SMB requires packet signing.
It determines whether or not SMB packet signing must be negotiated first before further communication
with an SMB client is allowed.
The setting after that, which is Microsoft Network Server digitally sign communications if client agrees,
determines whether the SMB server will negotiate SMB packet signing with the client that requested with
this enabled, the sub server will negotiate packet signing as per the request of the client.
If packet signing is enabled on the client, then it will be negotiated by the server.
By default.
This option is only enabled on domain controllers, so you will click on the first one and it's a good
practice to take a look at the explanation tab.
This tab gives you a good explanation of what the setting does.
What's important to note is the default options for the setting.
You can see here it's enabled by default for domain controllers but disabled for member servers.
Since you need to enforce this across your entire domain, you will go ahead and define the policy and
click on Enabled.
What's also important to note is the article that Microsoft links in the setting.
This will highlight any kind of compatibility issues that you might run into with other services or
applications.
Since we don't have any other services or applications or clients that would cause compatibility issues,
you will click on, okay.
And again, you are present with warning and you'll accept this to define the setting.
We will follow the same process for the next option.
Now let's configure SMB signing for clients.
As you scroll a little bit up, you will notice you've got the Microsoft Network client digitally sign
communications always and if server agrees options.
The first one ensures that the SMB client will always require packet signing if the server does not
agree to support packets signing with the client.
The client will not communicate with the server.
The one below that determines whether the SMB client attempts to negotiate SMB packet signing with the
server.
So now you will go ahead and define the options to enable these two settings.
Once these are enabled and the group policy refresh takes place, you have successfully enabled SMB
signing.
Now let's move on to SMB encryption.
Before we enable SMB encryption, let's take a look at what is the configuration setting currently on
the file server.
You will right click and the file server and click on Windows PowerShell and within PowerShell you will
issue the command.
Get SMB server configuration.
You will notice that the encrypt data option is set to false.
This means that SMB encryption is not enabled.
Let's verify what dialects are currently used for SMB to view the current protocol version that's being
used.
Either should a command get SMB connection on my Windows Administrative Machine, and you'll notice
that SMB version 3.1 is being used.
Since security is a priority for the company, let's ensure that we enable SMB encryption across all
file shares.
By issuing the command set SMB server configuration encrypt data with a value of true and false.
You have now enabled SMB encryption.
Let's take a look at the SMB server configuration settings again and you'll see that the encrypt data
option is now set to true.
Now let's go ahead and reject unencrypted SMB connections.
And in order to reject unencrypted access, this can be done using the said SMB server configuration.
Reject unencrypted access with a value of true and you should have warning that would ask you to confirm.
And in this case, we're going to confirm this.
Now, SMB encryption has been enabled successfully.
You can confirm this by navigating to server manager, selecting your file, server, navigating to
file and storage services, clicking on shares and under the file share, you can right click click
on properties and under settings.
You'll notice that the Encrypt Data Access has been selected.
Alternatively, if you did not use PowerShell, you could come to this exact same setting and simply
tick the box and click on.
Okay.
That brings you to the end of this demonstration where you have successfully enabled SMB encryption,
SMB signing and disabled SMB version one.