Objective
Require SMB signing through a small Windows pilot, distinguish client and server policy, and validate the NAS, scan-to-folder and application paths used by the business.
- Capture effective settings before enforcement and use the intended management authority.
- Test both Windows file access and device/application workflows.
- Do not weaken the fleet-wide signing policy to accommodate one uninvestigated endpoint.
Prerequisites
- Windows editions/builds and effective client/server signing settings for the pilot.
- A list of file servers, NAS devices, printers and applications using SMB.
- An authorized management-policy owner, test identities and representative shares.
- A planned interruption/reconnection window and the previous policy configuration.
Step-by-step procedure
Establish the baseline and scope
Record editions/builds, the effective settings in both directions and the management policy that supplies them. List representative shares, accounts, scan devices and application paths, then test their current behavior before applying the pilot requirement.
- The selected devices or site, timing, previous state and expected result are recorded.
Check and require outbound signing on a pilot
Inventory the Windows edition/build and effective client policy before changing it. RequireSecuritySignature controls whether the SMB client requires signing for outbound connections. Apply the intended setting through the authoritative management policy to a small group, then test new connections to representative shares. A local PowerShell setting can be overwritten by domain or device-management policy.
- The effective client requirement and the results of the pilot’s outbound share access are recorded.
Treat the server requirement separately
Record the inbound server setting independently of the client setting. Windows 11 24H2 Pro, Enterprise and Education require both directions by default; Windows Server 2025 requires outbound signing by default. Do not assume every edition, upgraded machine or managed system has the same effective state. Enforce the server requirement only after checking the clients that use its shares.
- Both directions and the authoritative policy are documented instead of inferred from one machine’s default.
Check NAS and third-party SMB compatibility
List the NAS and other third-party SMB endpoints in the pilot’s business paths. Verify supported signing and authenticated access with the vendor and test the actual share. Signing protects integrity and is distinct from SMB encryption; an Encrypted field is not a substitute for a signing check. Update incompatible equipment or its configuration through the approved change process.
- The affected endpoint, capability and authenticated test result are known before wider enforcement.
Test scan-to-folder and guest dependencies
Test scanners, multifunction printers and scheduled transfers that use SMB shares. Confirm the account, destination share and device signing support; a user’s Windows file-copy test does not cover the printer’s SMB client. Required signing is incompatible with guest access. Resolve the device or authenticated-access requirement rather than enabling guest access as a diagnostic shortcut.
- Each scan or transfer workflow succeeds with its intended identity, or its compatibility gap is assigned for remediation.
Validate real sessions and applications
After the pilot change, establish a fresh connection and repeat the application workflow. Read RequireSecuritySignature for policy and inspect active connections for available session evidence. A projected Signed property may be unavailable on some builds: a blank value is not False and cannot prove an unsigned session. Correlate supported diagnostics and logs before widening the policy.
- Policy, connection evidence and the business workflow agree; unsupported or missing fields remain an explicit evidence gap.
Validate the complete service
Complete the subject-specific validation below and retain the result and evidence. A command or setup phase that succeeds does not on its own establish that the whole service is ready.
- The complete intended workflow is checked using the criteria below.
Examples: observations and changes
Read the existing settings before applying either change. The Set commands require appropriate administrative access and change only the selected machine; use the authoritative policy for a managed fleet. Establish fresh test connections after the change. Do not run the entire list as an automatic fleet-wide configuration script.
Observe the outbound client requirement
Get-SmbClientConfiguration | Format-List RequireSecuritySignatureObserve the inbound server requirement
Get-SmbServerConfiguration | Format-List RequireSecuritySignatureInspect active client connections; an unavailable Signed property is not False
Get-SmbConnection | Select-Object ServerName,ShareName,Dialect,Signed,EncryptedConfiguration change on an authorized pilot: require outbound signing
Set-SmbClientConfiguration -RequireSecuritySignature $trueConfiguration change on an authorized pilot: require inbound signing
Set-SmbServerConfiguration -RequireSecuritySignature $truePolicy refresh on the domain-managed pilot; this can apply other pending Group Policy settings
gpupdate /forceRecheck the effective outbound requirement
Get-SmbClientConfiguration | Format-List RequireSecuritySignatureRecheck the effective inbound requirement
Get-SmbServerConfiguration | Format-List RequireSecuritySignatureValidation
The procedure is validated when:
- The expected client and server requirements are effective under the authoritative policy.
- New SMB connections and representative file, scan and application workflows succeed.
- Available session evidence and logs are reviewed without treating a missing field as False.
Rollback
- Stop the rollout at the pilot boundary if a required workflow fails.
- Use the recorded policy and the organization’s approved exception/recovery process for the affected pilot.
- Resolve the specific incompatible endpoint; do not publish a blanket disable-signing or guest-access workaround.
Troubleshooting / common errors
- Windows share access works but scanning fails: inspect the printer’s SMB client, account and signing capability.
- Local settings revert: inspect the domain/MDM policy rather than repeatedly overwriting the machine.
- Signed appears blank: check build support and available diagnostics; do not read a missing property as False.
- Only one NAS fails: verify its authenticated SMB configuration and supported firmware with the vendor.
Official references
Keep the scope, original state, observed evidence and validated outcome with the procedure record. Consult the official documentation for the installed version.