Simple definition
SMB Signing is an integrity mechanism that allows SMB clients and servers to cryptographically sign exchanged messages.
Technical definition
SMB signing adds a value to each message that is calculated from the negotiated session key. The receiving peer can verify that the message was not altered in transit and belongs to the expected session. Depending on the SMB version and applied policy, signing can be supported, negotiated, or required.
How it works / role
Its main role is to strengthen SMB message integrity and reduce the risk of tampering and certain relay attacks. It does not encrypt the payload; SMB Encryption is the relevant control when confidentiality is also required and supported.
What is it used for?
Protect access to file shares, SYSVOL, applications, and other SMB-based services, especially when traffic crosses less trusted network segments.
Practical example
A file server requires SMB signing. When a workstation opens a share, the client and server establish the SMB session and sign subsequent messages; a modified or injected message with an invalid signature is rejected.
Common issues
- Signing is required on one side but unsupported or disabled on the other
- Legacy device or application is incompatible with the chosen policy
- Performance impact on some legacy or heavily loaded environments
- Confusion between SMB signing, authentication, and SMB encryption
Key takeaway: SMB Signing protects message integrity; it does not replace strong authentication or SMB encryption.