Detections
Analytics

45.5 Ensure 'Enable Auth Rate Limiter' is set to 'Enabled'

Information

This policy settings configures the Server Message Block (SMB) server authentication rate limiter. The authentication rate limiter is a feature of SMB that is designed to address brute force attacks.

The recommended state for this setting is: Enabled.

Note: This setting should be used in conjunction with the setting Set authentication rate limiter delay (milliseconds).

Authentication rate limiter considerably reduces the risk of brute force attacks by implementing a 2-second delay (default) between each failed NTLM or PKU2U-based authentication attempt.

According to Microsoft https://learn.microsoft.com/en-us/windows-server/storage/file-server/configure-smb-authentication-rate-limiter?tabs=powershell#how-smb-authentication-rate-limiter-works, if a threat actor sends 300 brute force attempts per second from a client for 5 minutes which equals 90,000 passwords, the same number of attempts would now take 50 hours or more.

Solution

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Enabled :

Lanman Server\Enable Auth Rate Limiter

Impact:

None - this is the default behavior.

See Also

https://workbench.cisecurity.org/benchmarks/27282

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7(20)

Plugin: Windows

Control ID: 7a3643766a3d565f8f4c23b8a663e061b2a9265bca357b0b1dddc2728df63b83