{"id":436875,"date":"2023-09-26T01:41:00","date_gmt":"2023-09-25T20:11:00","guid":{"rendered":"https:\/\/www.thewindowsclub.com\/?p=436875"},"modified":"2023-09-23T10:23:41","modified_gmt":"2023-09-23T04:53:41","slug":"block-ntlm-attacks-over-smb-in-windows","status":"publish","type":"post","link":"https:\/\/www.thewindowsclub.com\/block-ntlm-attacks-over-smb-in-windows","title":{"rendered":"Block NTLM attacks over SMB in Windows 11 using GPEDIT or PowerShell"},"content":{"rendered":"

If you want to block NTLM attacks over SMB<\/strong> in Windows 11, here is how you can do that. An administrator can block all the NTLM attacks over Server Message Block with the help of the Local Group Policy Editor and Windows PowerShell.<\/p>\n

If you are a system administrator, you must know that the SMB or Server Message Block is one of the essential protocols required for various types of sharing, including files, printers, etc., over a shared network, e.g., office, business, etc.<\/p>\n

On the other hand, NTLM or Windows New Technology LAN Manager allows users to authenticate users for outbound remote connections.\u00a0An attacker can take advantage of or manipulate NTLM to authenticate him\/her to attack your computer or even the entire network.<\/p>\n

To prevent such attacks, Microsoft has included a new security measure, and here is how you can enable it.<\/p>\n

Block NTLM attacks over SMB in Windows 11 using GPEDIT<\/h2>\n

\"Block<\/p>\n

To block NTLM attacks over SMB in Windows 11 using GPEDIT, follow these steps:<\/p>\n

    \n
  1. Press\u00a0Win+R <\/strong>to open the Run prompt.<\/li>\n
  2. Type gpedit.m<\/strong>sc\u00a0<\/strong>and hit the\u00a0Enter\u00a0<\/strong>button.<\/li>\n
  3. Navigate to\u00a0Lanman Workstation\u00a0<\/strong>in\u00a0Computer Configuration<\/strong>.<\/li>\n
  4. Double-click on the\u00a0Block NTLM (LM, NTLM, NTLMv2)\u00a0<\/strong>setting.<\/li>\n
  5. Choose the\u00a0Enabled\u00a0<\/strong>option.<\/li>\n
  6. Click the\u00a0OK\u00a0<\/strong>button.<\/li>\n<\/ol>\n

    To learn more about these steps, continue reading.<\/p>\n

    First, you need to open the Local Group Policy Editor. For that, press\u00a0Win+R<\/strong>\u00a0to display the Run prompt, type\u00a0gpedit.msc<\/strong>, and hit the\u00a0Enter\u00a0<\/strong>button.<\/p>\n

    Next, navigate to the following path:<\/p>\n

    Computer Configuration > Administrative Templates > Network > Lanman Workstation<\/p>\n

    Double-click on the\u00a0Block NTLM (LM, NTLM, NTLMv2)\u00a0<\/strong>setting and choose the\u00a0Enabled\u00a0<\/strong>option.<\/p>\n

    Click the\u00a0OK\u00a0<\/strong>button to save the change.<\/p>\n

    Block NTLM attacks over SMB in Windows 11 using PowerShell<\/h3>\n

    \"Block<\/p>\n

    To block NTLM attacks over SMB in Windows 11 using PowerShell, follow these steps:<\/p>\n

      \n
    1. Press\u00a0Win+X\u00a0<\/strong>to open the menu.<\/li>\n
    2. Select the\u00a0Terminal (Admin)\u00a0<\/strong>option.<\/li>\n
    3. Click on the\u00a0Yes\u00a0<\/strong>button.<\/li>\n
    4. Enter this command: Set-SMbClientConfiguration -BlockNTLM $true<\/em><\/li>\n<\/ol>\n

      Let\u2019s check out these steps in detail.<\/p>\n

      To get started, you need to open the PowerShell with administrator privileges. For that, press\u00a0Win+X<\/strong>\u00a0and choose the\u00a0Terminal (Admin)\u00a0<\/strong>option. Next, click the\u00a0Yes\u00a0<\/strong>button on the UAC prompt.<\/p>\n

      After that, make sure you have a PowerShell instance opened in the Windows Terminal. If so, enter this command:<\/p>\n

      Set-SMbClientConfiguration -BlockNTLM $true<\/pre>\n
      It is also possible to specify SMB NTLM blocking while mapping a drive. For that, you need to use this command:<\/p>\n
      New-SmbMapping -RemotePath\u00a0\\\\server\\share<\/em>\u00a0-BlockNTLM $true<\/pre>\n
      That\u2019s all! I hope this guide helps you.<\/p>\n
      Read: <\/strong>Why and how to disable SMB1 on Windows<\/a><\/p>\n
      How do I disable NTLMv1 in Windows 11?<\/h3>\n
      To disable NTMLv1 in Windows 11, you need to use NTMLv2 only. For that, open the Local Group Policy Editor and navigate to this path: Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options. Double-click on the\u00a0Network security: LAN Manager authentication level\u00a0<\/em>setting and choose the\u00a0Send NTMLv2 response only. Refuse LM & NTLM\u00a0<\/em>option and click the\u00a0OK\u00a0<\/em>button.<\/p>\n
      Does SMB use NTLM?<\/h3>\n
      Yes, SMB or Server Message Block uses NTLM in Windows 11. NTLM is required to authenticate the user\u2019s identity for outbound connections. It is mainly used when you try to share files, printers, or other devices or drives over a shared network in an office or some other place.<\/p>\n
      Read: <\/strong>How to check SMB version on Windows.<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
      If you want to block NTLM attacks over SMB in Windows 11, here is how you can do that. An administrator can block all the NTLM attacks over Server Message Block with the help of the Local Group Policy Editor and Windows PowerShell. If you are a system administrator, you must know that the SMB […]<\/p>\n","protected":false},"author":91,"featured_media":436877,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[6],"tags":[990],"yoast_head":"\nBlock NTLM attacks over SMB in Windows 11: GPEDIT, PowerShell<\/title>\n<meta name=\"description\" content=\"Learn how to block NTLM attacks over SMB in Windows 11 using Local Group Policy Editor and Windows PowerShell using these step-by-step guide.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.thewindowsclub.com\/block-ntlm-attacks-over-smb-in-windows\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Block NTLM attacks over SMB in Windows 11 using GPEDIT or PowerShell\" \/>\n<meta property=\"og:description\" content=\"Learn how to block NTLM attacks over SMB in Windows 11 using Local Group Policy Editor and Windows PowerShell using these step-by-step guide.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.thewindowsclub.com\/block-ntlm-attacks-over-smb-in-windows\" \/>\n<meta property=\"og:site_name\" content=\"The Windows Club\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/TheWindowsClub\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/sudipmus\" \/>\n<meta property=\"article:published_time\" content=\"2023-09-25T20:11:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-09-23T04:53:41+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.thewindowsclub.com\/wp-content\/uploads\/2023\/09\/block-ntlm-attacks-smb.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"999\" \/>\n\t<meta property=\"og:image:height\" content=\"631\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"SudipMajhi@TWC\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@https:\/\/twitter.com\/sudipmus\" \/>\n<meta name=\"twitter:site\" content=\"@TheWindowsClub\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Block NTLM attacks over SMB in Windows 11: GPEDIT, PowerShell","description":"Learn how to block NTLM attacks over SMB in Windows 11 using Local Group Policy Editor and Windows PowerShell using these step-by-step guide.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.thewindowsclub.com\/block-ntlm-attacks-over-smb-in-windows","og_locale":"en_US","og_type":"article","og_title":"Block NTLM attacks over SMB in Windows 11 using GPEDIT or PowerShell","og_description":"Learn how to block NTLM attacks over SMB in Windows 11 using Local Group Policy Editor and Windows PowerShell using these step-by-step guide.","og_url":"https:\/\/www.thewindowsclub.com\/block-ntlm-attacks-over-smb-in-windows","og_site_name":"The Windows Club","article_publisher":"https:\/\/www.facebook.com\/TheWindowsClub","article_author":"https:\/\/www.facebook.com\/sudipmus","article_published_time":"2023-09-25T20:11:00+00:00","article_modified_time":"2023-09-23T04:53:41+00:00","og_image":[{"width":999,"height":631,"url":"https:\/\/www.thewindowsclub.com\/wp-content\/uploads\/2023\/09\/block-ntlm-attacks-smb.jpg","type":"image\/jpeg"}],"author":"SudipMajhi@TWC","twitter_card":"summary_large_image","twitter_creator":"@https:\/\/twitter.com\/sudipmus","twitter_site":"@TheWindowsClub","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"TechArticle","@id":"https:\/\/www.thewindowsclub.com\/block-ntlm-attacks-over-smb-in-windows#article","isPartOf":{"@id":"https:\/\/www.thewindowsclub.com\/block-ntlm-attacks-over-smb-in-windows"},"author":{"name":"SudipMajhi@TWC","@id":"https:\/\/www.thewindowsclub.com\/#\/schema\/person\/b91852059c881643c591f1d4c5b794bd"},"headline":"Block NTLM attacks over SMB in Windows 11 using GPEDIT or PowerShell","datePublished":"2023-09-25T20:11:00+00:00","dateModified":"2023-09-23T04:53:41+00:00","mainEntityOfPage":{"@id":"https:\/\/www.thewindowsclub.com\/block-ntlm-attacks-over-smb-in-windows"},"wordCount":568,"commentCount":0,"publisher":{"@id":"https:\/\/www.thewindowsclub.com\/#organization"},"keywords":["LAN"],"articleSection":["Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.thewindowsclub.com\/block-ntlm-attacks-over-smb-in-windows#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.thewindowsclub.com\/block-ntlm-attacks-over-smb-in-windows","url":"https:\/\/www.thewindowsclub.com\/block-ntlm-attacks-over-smb-in-windows","name":"Block NTLM attacks over SMB in Windows 11: GPEDIT, PowerShell","isPartOf":{"@id":"https:\/\/www.thewindowsclub.com\/#website"},"datePublished":"2023-09-25T20:11:00+00:00","dateModified":"2023-09-23T04:53:41+00:00","description":"Learn how to block NTLM attacks over SMB in Windows 11 using Local Group Policy Editor and Windows PowerShell using these step-by-step guide.","breadcrumb":{"@id":"https:\/\/www.thewindowsclub.com\/block-ntlm-attacks-over-smb-in-windows#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.thewindowsclub.com\/block-ntlm-attacks-over-smb-in-windows"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.thewindowsclub.com\/block-ntlm-attacks-over-smb-in-windows#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Security","item":"https:\/\/www.thewindowsclub.com\/category\/security"},{"@type":"ListItem","position":2,"name":"Block NTLM attacks over SMB in Windows 11 using GPEDIT or PowerShell"}]},{"@type":"WebSite","@id":"https:\/\/www.thewindowsclub.com\/#website","url":"https:\/\/www.thewindowsclub.com\/","name":"TheWindowsClub","description":"TheWindowsClub covers authentic Windows 11, Windows 10 tips, tutorials, how-to's, features, freeware. Created by Anand Khanse, MVP.","publisher":{"@id":"https:\/\/www.thewindowsclub.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.thewindowsclub.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.thewindowsclub.com\/#organization","name":"TheWindowsClub","url":"https:\/\/www.thewindowsclub.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.thewindowsclub.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.thewindowsclub.com\/wp-content\/uploads\/2020\/01\/cropped-TheWindowsClub-Icon.png","contentUrl":"https:\/\/www.thewindowsclub.com\/wp-content\/uploads\/2020\/01\/cropped-TheWindowsClub-Icon.png","width":512,"height":512,"caption":"TheWindowsClub"},"image":{"@id":"https:\/\/www.thewindowsclub.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/TheWindowsClub","https:\/\/twitter.com\/TheWindowsClub","https:\/\/www.instagram.com\/the_windows_club\/","https:\/\/www.linkedin.com\/groups\/1946790\/","http:\/\/www.myspace.com\/thewindowsclub","http:\/\/pinterest.com\/thegeeksclub\/twc-tech\/","https:\/\/www.youtube.com\/c\/TheWindowsClubVideos"]},{"@type":"Person","@id":"https:\/\/www.thewindowsclub.com\/#\/schema\/person\/b91852059c881643c591f1d4c5b794bd","name":"SudipMajhi@TWC","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.thewindowsclub.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/bd28e024a1bf4440001cade8abb4b0a0?s=96&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/bd28e024a1bf4440001cade8abb4b0a0?s=96&r=g","caption":"SudipMajhi@TWC"},"description":"When he is not writing about Microsoft Windows or Office, Sudip likes to work with Photoshop. He has managed the front end and back end of many websites over the years. He is currently pursuing his Bachelor's degree.","sameAs":["https:\/\/www.facebook.com\/sudipmus","http:\/\/in.linkedin.com\/in\/sudipmajhi","https:\/\/twitter.com\/https:\/\/twitter.com\/sudipmus"]}]}},"_links":{"self":[{"href":"https:\/\/www.thewindowsclub.com\/wp-json\/wp\/v2\/posts\/436875"}],"collection":[{"href":"https:\/\/www.thewindowsclub.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thewindowsclub.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thewindowsclub.com\/wp-json\/wp\/v2\/users\/91"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thewindowsclub.com\/wp-json\/wp\/v2\/comments?post=436875"}],"version-history":[{"count":3,"href":"https:\/\/www.thewindowsclub.com\/wp-json\/wp\/v2\/posts\/436875\/revisions"}],"predecessor-version":[{"id":436885,"href":"https:\/\/www.thewindowsclub.com\/wp-json\/wp\/v2\/posts\/436875\/revisions\/436885"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thewindowsclub.com\/wp-json\/wp\/v2\/media\/436877"}],"wp:attachment":[{"href":"https:\/\/www.thewindowsclub.com\/wp-json\/wp\/v2\/media?parent=436875"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thewindowsclub.com\/wp-json\/wp\/v2\/categories?post=436875"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thewindowsclub.com\/wp-json\/wp\/v2\/tags?post=436875"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}