AD-DC-04: SMB signing should be enabled on all domain controllers


ID	`AD-DC-04`
Severity	High
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Domain controllers
Security area	Infrastructure hardening
Resource type	DomainController
User impact of fixing	Low
Effort to fix	Low
Framework controls	`nist-800-53-r5:SC-8` Transmission Confidentiality and Integrity
MITRE ATT&CK	T1557
Reads from	On-premises Active Directory

What this checks and how to fix it

SMB signing (also known as security signatures) is a security feature that helps prevent:

Man-in-the-middle attacks: Attackers cannot modify SMB packets in transit
Session hijacking: Ensures the integrity of SMB sessions
Replay attacks: Prevents attackers from replaying captured SMB traffic

Without SMB signing, an attacker on the network could intercept and modify SMB traffic between clients and domain controllers.

Control Type

Preventive

Security Recommendation

Enable SMB signing on all domain controllers.

To enable SMB signing:

#### Check current status
Get-SmbServerConfiguration | Select-Object EnableSecuritySignature, RequireSecuritySignature

#### Enable SMB signing
Set-SmbServerConfiguration -EnableSecuritySignature $true -RequireSecuritySignature $true -Force

You can also enforce SMB signing through Group Policy:

Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options
“Microsoft network server: Digitally sign communications (always)” = Enabled

How the Test Works

This test queries the SMB server configuration on each domain controller to check if SMB signing is enabled and required. It reports:

Number of DCs with signing enabled
Number of DCs with signing required
Names of DCs without signing enabled

Test-MtAdDcSmbv1EnabledCount - SMBv1 protocol status
Test-MtAdDcSmbv311EnabledCount - SMBv3.1.1 protocol status

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).