How to Configure SMB Signing and Encryption in Windows 11 Using PowerShell

Server Message Block (SMB) is the backbone protocol powering Windows network file sharing, printer connectivity, and domain communication. However, unencrypted and unsigned SMB traffic is historically vulnerable to man-in-the-middle (MitM) attacks, credential relay exploits, and eavesdropping. Starting in recent updates of Windows 11 (including version 24H2 and modern Enterprise/Pro builds), Microsoft has hardened default security postures by requiring SMB signing by default for all client connections.

While increased security safeguards organizational data, mismatched SMB signing or encryption requirements between Windows 11 workstations and older NAS devices, Samba servers, or third-party storage appliances can result in frustrating “Access Denied” or 0x80070035 network path errors. Using PowerShell, administrators can query active SMB client and server configurations, enforce end-to-end encryption, mandate or relax signing requirements, and audit connection security. If you actively manage Windows infrastructure via scripting, you can also explore our guides on managing network adapter power settings in Windows 11 and auditing digital certificates using PowerShell.

Launching PowerShell with Elevated Administrative Privileges

Modifying kernel-level networking protocols and security configurations requires an administrative PowerShell session:

1. Press Windows Key + X or right-click the Start menu button on your taskbar.
2. Select Terminal (Admin) or PowerShell (Admin).
3. Click Yes when prompted by the User Account Control (UAC) dialogue.

Inspecting Current SMB Client and Server Configurations

Before adjusting security policies, review your current SMB client parameters using Get-SmbClientConfiguration:

# Query active SMB client settings
Get-SmbClientConfiguration | Select-Object EnableSecuritySignature, RequireSecuritySignature, EnableSMB1Protocol, EnableInsecureGuestLogons

# Query SMB server settings (if hosting local shares)
Get-SmbServerConfiguration | Select-Object EnableSecuritySignature, RequireSecuritySignature, EncryptData

Understanding these boolean settings is critical:

• EnableSecuritySignature: Determines whether the SMB client advertises digital signing capabilities during session negotiation. (Recommended: True).
• RequireSecuritySignature: Mandates that the remote file server sign every packet with a cryptographic hash. If the remote server does not support signing, Windows aborts the connection.
• EncryptData: Enforces AES-128 or AES-256 end-to-end payload encryption across the wire, safeguarding file contents from packet sniffing.

Configuring and Enforcing SMB Signing via PowerShell

To mandate SMB signing across all outbound network connections from your Windows 11 machine:

# Enforce mandatory SMB client signing
Set-SmbClientConfiguration -RequireSecuritySignature $true -Confirm:$false

# Verify that signing is enabled and required
Get-SmbClientConfiguration | Select-Object EnableSecuritySignature, RequireSecuritySignature

If you are troubleshooting temporary access to a legacy network-attached storage (NAS) appliance that does not support SMB signing, you can relax the requirement temporarily while diagnosing the environment:

# Temporarily disable mandatory client signing for troubleshooting
Set-SmbClientConfiguration -RequireSecuritySignature $false -Confirm:$false

Enforcing End-to-End SMB Encryption

SMB encryption guarantees that all transferred files, metadata, and directory listings are cryptographically protected over local Wi-Fi or untrusted networks. While SMB 3.0+ negotiates encryption per share, you can enforce encryption globally on your Windows 11 host:

# Require encryption on all hosted shares
Set-SmbServerConfiguration -EncryptData $true -Confirm:$false

# Restrict cipher suites to modern AES-256-GCM and AES-256-CCM
Set-SmbServerConfiguration -EncryptionCiphers "AES_256_GCM, AES_256_CCM" -Confirm:$false

Auditing Active SMB Connections in Real Time

To verify whether an active network share connection is actually signed, encrypted, or operating over SMB 3.1.1, execute Get-SmbConnection while connected to a remote share:

Get-SmbConnection | Select-Object ServerName, ShareName, Dialect, NumOpens, Signed, Encrypted

The resulting table displays your active SMB session properties:

• Dialect: Confirms the protocol version (such as 3.1.1 or 3.0.2). Connections operating on obsolete dialects like 2.1 or 1.5 should be decommissioned.
• Signed: Displays True if packets carry an HMAC-SHA256 or AES-GMAC signature.
• Encrypted: Displays True if full wire encryption is actively protecting payload data.

Using PowerShell cmdlets ensures rapid validation, rock-solid security postures, and prompt resolution of enterprise storage connectivity issues across Windows 11.