How to Block NTLM Over SMB in Windows 11 Using PowerShell

In modern enterprise and home network environments, Server Message Block (SMB) file sharing remains one of the primary targets for adversary reconnaissance and lateral movement. Attackers frequently exploit legacy NT LAN Manager (NTLM) authentication through credential reflection, brute-force pass-the-hash attacks, and relay vulnerabilities like PetitPotam and ShadowCoerce. To neutralize these exposure surfaces, Microsoft introduced dedicated security controls in Windows 11 that allow administrators to block NTLM over SMB completely, ensuring that all client and server authentication strictly relies on Kerberos.

When NTLM over SMB is blocked, outbound connections to remote SMB file shares will refuse to downgrade to NTLM if Kerberos fails. Simultaneously, an SMB server configured with this policy will reject any inbound authentication attempts requesting NTLM. By combining audit logging with enforcement flags via PowerShell, you can assess network compatibility before shutting down legacy authentication across your systems.

Understanding SMB Authentication and NTLM Risks

Whenever a Windows 11 workstation initiates a file transfer or administrative connection to an SMB share, the local security authority attempts to negotiate Kerberos tickets. However, if the destination server is specified via an IP address instead of a Fully Qualified Domain Name (FQDN), or if Service Principal Names (SPNs) are missing or misconfigured, Windows historically defaulted to NTLM authentication.

NTLM relies on challenge-response mechanisms that transmit cryptographic hashes across the network. If an attacker intercepts these exchanges or coaxes a host into authenticating against a rogue SMB listener, the attacker can relay those credentials to gain unauthorised privileges on other domain servers. Enforcing Kerberos guarantees mutual authentication and prevents intermediate relay exploits entirely.

Auditing NTLM SMB Connections Before Enforcement

Before outright blocking NTLM, audit your existing SMB traffic to identify any legacy devices, network-attached storage (NAS) appliances, or automation scripts that still rely on NTLM. This prevents sudden workflow disruptions across your environment.

Open an elevated PowerShell prompt on Windows 11 by right-clicking the Start menu and selecting Terminal (Admin). Check your current SMB client configuration:

Get-SmbClientConfiguration | Select-Object EnableSMB1Protocol, BlockNTLM, AuditSmbBlockNTLM

To enable auditing without dropping connections, configure the SMB client to log all NTLM authentication events to the Windows Event Viewer:

Set-SmbClientConfiguration -AuditSmbBlockNTLM $true -Force

If the workstation also hosts local file shares or services inbound connections, enable audit logging on the SMB server configuration as well:

Set-SmbServerConfiguration -AuditSmbBlockNTLM $true -Force

With auditing active, review security logs using PowerShell to see if any outbound connection attempts triggered NTLM fallbacks:

Get-WinEvent -LogName "Microsoft-Windows-SMBClient/Operational" | Where-Object { $_.Id -eq 31017 } | Format-List -Property TimeCreated, Message

Event ID 31017 logs any outbound SMB connection that authenticated using NTLM while auditing was enabled. If this query returns no events during typical daily operations, your network is ready for full NTLM blocking.

Blocking Outbound NTLM Authentication on the SMB Client

Once auditing confirms that critical resources correctly negotiate Kerberos, block outbound NTLM traffic from your Windows 11 client. This prevents the workstation from ever sending NTLM credentials to external or remote servers:

Set-SmbClientConfiguration -BlockNTLM $true -Force

Verify that the setting was committed successfully:

Get-SmbClientConfiguration | Select-Object BlockNTLM, AuditSmbBlockNTLM

From this point forward, if an application attempts to access a remote share using an IP address (such as \\192.168.1.50\Public) without valid Kerberos tickets, Windows will reject the connection with an access denied error rather than downgrading to NTLM. Always ensure you connect to file shares using their NetBIOS or DNS hostname (e.g., \\nas01.corp.local\Public) to facilitate proper Kerberos SPN resolution.

Blocking Inbound NTLM Authentication on the SMB Server

To ensure that the local Windows 11 machine refuses inbound connections from clients attempting to authenticate with NTLM, enforce the blocking rule on the SMB server service:

Set-SmbServerConfiguration -BlockNTLM $true -Force

Confirm the operational status of the server configuration:

Get-SmbServerConfiguration | Select-Object BlockNTLM, AuditSmbBlockNTLM

Any incoming connection request attempting NTLM negotiation will now be terminated at the session setup phase. Event ID 1041 in the Microsoft-Windows-SMBServer/Operational channel will capture any blocked connection attempts alongside the source IP address.

Configuring SMB Client Exceptions for Specific Hosts

In certain enterprise architectures, a dedicated legacy backup appliance or industrial controller may strictly require NTLM. Rather than disabling security globally, Windows 11 allows administrators to maintain the global block while specifying explicit exceptions for trusted endpoints.

To view existing client block exceptions, run:

Get-SmbClientBlockNTLMException

To grant a specific host an exemption from the NTLM block, add its server name or DNS alias to the exception list:

New-SmbClientBlockNTLMException -ServerName "legacy-storage.corp.local"

You can remove an exemption once the legacy device has been replaced or upgraded to support Kerberos:

Remove-SmbClientBlockNTLMException -ServerName "legacy-storage.corp.local" -Force

Testing and Verifying Connection Hardening

To verify that the block is actively protecting your environment, attempt a mapped network drive connection to a non-domain IP address:

Test-NetConnection -ComputerName "192.168.1.100" -Port 445

Next, attempt an explicit connection using the net use command against the IP endpoint:

net use Z: \\192.168.1.100\share

Because IP addresses cannot resolve Kerberos SPNs natively and NTLM is blocked, Windows immediately halts authentication, logging the block in the operational event channel. This confirms that your Windows 11 system is impervious to NTLM credential harvesting and relay attacks over SMB.