I've been having some strange file copy issues between a Windows 10 client and Window Server 2019 system (DC/Fileserver).
I don't want to explain that issue in detail here other than to say it appears it is caused by SMB signing (random Invalid Signature on file copies). I have validated that the issue goes away when using SMB encryption (implemented by enabling RequirePrivacy=1 in Hardened UNC path setting). My Wireshark capture shows in the Negotiate Protocol Response (SMB 3.1.1 is used dialect):
Security mode: 0x03, Signing enabled, Signing required
.... ...1 = Signing enabled: True
.... ..1. = Signing required: True
However according to Microsoft
When requiring SMB Encryption, SMB Signing is not used, regardless of settings. SMB Encryption implicitly provides the same integrity guarantees as SMB Signing
So, in effect I have disabled signing by using encryption instead. With this enabled my "issue" doesn't exist.
I would like to try this without the use of encryption and instead with signing disabled. Unfortunately, I can't get windows to turn this off. I have done the following:
1) Configured my local Windows 10 client's security policy:
Microsoft network client: Digitally sign communications (always) = DISABLED
Microsoft network client: Digitally sign communications (if server agrees) = DISABLED
(The second setting according to Microsoft shouldn't even be required for SMB2 communication)
2) Configured my Windows Server 2019 DC via the Domain Controllers GPO:
Microsoft network server: Digitally sign communications (always) = DISABLED
Microsoft network server: Digitally sign communications (if client agrees) = DISABLED
(The second setting according to Microsoft shouldn't even be required for SMB2 communication)
Based on my understanding that should be all that is required to disable SMB2 signing. However I have additionally tried the following:
Disabled SecuritySignature on the DC's SMB:
- Set-SmbServerConfiguration -EnableSecuritySignature $false
- Set-SmbServerConfiguration -RequireSecuritySignature $false
I'm not sure if the above actually deal with SMB2 signing or only SMB1, but I set them anyway in addition to disabling these on my client (Set-SmbClientConfiguration settings)
I have also tried to set the UNC Hardening keys on my Windows 10 system to RequireIntegrity=0.
None of these settings work to disable SMB signing. The best I get in my Wireshark capture Negotiate Protocol Response is:
Security mode: 0x01, Signing enabled
.... ...1 = Signing enabled: True
.... ..0. = Signing required: False
So I've succeeded in disabling the requirement for signing, but I can't actually get the signing to turn off.
I can't find anything that states that signing can't be disabled, so either there is a bug - or I'm missing something.
Help?