Detections
Analytics

46.3 Ensure 'Audit Server Does Not Support Signing' is set to 'Enabled'

Information

This policy setting determines whether the Server Message Block (SMB) client will log events when the SMB server doesn't support signing.

Enabling this will create event log entries in Applications and Services Logs\Microsoft\Windows\SMBServer\Audit, with Event ID 3022.

The recommended state for this setting is: Enabled.

Organizations should be aware of all unsigned SMB traffic in their environment. Older SMB protocols that do not use signing can make an environment susceptible to many types of attacks, including SMB interception attacks.

Solution

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Enabled :

Lanman Workstation\Audit Server Does Not Support Signing

Impact:

All SMB traffic that is unsigned will be logged as an event.

See Also

https://workbench.cisecurity.org/benchmarks/27282

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-3, 800-53|AU-3(1), 800-53|AU-7, 800-53|AU-12, CSCv7|6.3

Plugin: Windows

Control ID: e029b78c26f5d7530eb92aa662d5eb7bc56d3f6875048ff2e47dc343dfd177eb