Detections
Analytics

45.4 Ensure 'Auth Rate Limiter Delay In Ms' is set to '2000' or higher

Information

This policy settings configures the SMB server invalid authentication delay value in milliseconds.

The recommended state for this setting is: 2000 or higher.

Note: This setting should be used in conjunction with the setting Enable authentication rate limiter.

Authentication rate limiter considerably reduces the risk of brute force attacks by implementing a 2-second delay (default) between each failed NTLM or PKU2U-based authentication attempt.

According to Microsoft https://learn.microsoft.com/en-us/windows-server/storage/file-server/configure-smb-authentication-rate-limiter?tabs=powershell#how-smb-authentication-rate-limiter-works, if a threat actor sends 300 brute force attempts per second from a client for 5 minutes which equals 90,000 passwords, the same number of attempts would now take 50 hours or more.

Solution

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to 2000 or higher:

Lanman Server\Auth Rate Limiter Delay In Ms

Impact:

None - 2,000 milliseconds (2 seconds) is the default behavior.

See Also

https://workbench.cisecurity.org/benchmarks/27282

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7(20)

Plugin: Windows

Control ID: 0baf8871ff16b3bb8abeab7ebc0b00deaf2e612a5d17bfba8070b8d67b06ca46