RE: To disable SMB packet and secure channel signing enforcement on Windows Server 2003-based domain controllers

From: Serge Jorgensen (sjorgensen_at_usinfosec.com)
Date: 05/03/05

  • Next message: Langston, Fred: "RE: To disable SMB packet and secure channel signing enforcement on Windows Server 2003-based domain controllers" 
    Date: Tue, 3 May 2005 15:43:30 -0400
To: "Murad Talukdar" <talukdar_m@subway.com>, <focus-ms@securityfocus.com>

    Murad,

    Why not just share a folder on the local user's workstation? That
    doesn't require the changes on the DC, and you can always sync the
    folders back to the DC if you need some backup.

    R/
     Serge

    -----Original Message-----
    From: Murad Talukdar [mailto:talukdar_m@subway.com]
    Sent: Tuesday, May 03, 2005 3:32 AM
    To: focus-ms@securityfocus.com
    Subject: To disable SMB packet and secure channel signing enforcement on
    Windows Server 2003-based domain controllers

    Hi All,
    We have had arrival of new scanner/printer/copier in office. It uses SMB
    to scan files to shared folders on our W2003 network. In order for it to
    work however, I have had to do the following;

    1. From Administrative Tools open Domain Controller Security Policy 2.
    Smile 3. Select \Security Settings\Local Policies\Security Options
    folder. 4. In the details pane, double-click Microsoft network server:
    Digitally sign communications (always), and then click Disabled to
    prevent SMB packet signing from being required. 5. Click OK. 6. In the
    details pane, double-click Domain member: Digitally encrypt or sign
    secure channel data (always), and then click Disabled to prevent secure
    channel signing from being required. 7. Click OK.

    Before that, the scan would fail to be sent to the server in question.
    What are the implications of this--given that we do not ostensibly use
    SMB for anything else.
    I've heard scare stories of SMB man in the middle attacks and was under
    the impression that this is what these specific security settings were
    pertaining to but am not sure.

    There are other options for the scanning ie ftp/email but neither would
    work as we cannot get approval for cost of ftp server nor can the email
    system take the file sizes that are often req'd by scans our users make.

    I can see there will be advice against having shared user folders etc on
    DC's too but the big boss wants more from less if you see what I mean.

    Kind Regards
    Murad Talukdar

    ------------------------------------------------------------------------ 

    ---
------------------------------------------------------------------------
---
Sylint
Cyber Security,
Intelligence & Analysis
Serge Jorgensen
+1.941.951.6015
sjorgensen@usinfosec.com
The Sylint Group
PO Box 49886
Sarasota, Florida 34230 USA 
--------------------------------------------------------------------------------
This message, including any attachments, contains confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, please contact the sender immediately by reply email and destroy all copies. You are hereby notified that any disclosure, copying or distribution of this message, or the taking of any action based on it, is strictly prohibited.
---------------------------------------------------------------------------
---------------------------------------------------------------------------
  • Next message: Langston, Fred: "RE: To disable SMB packet and secure channel signing enforcement on Windows Server 2003-based domain controllers"

    Relevant Pages

    • Re: server 2003 - SDC doesnt copy shares and security
      ... All the domain controllers are at the same ... The active directory indeed synchronises the users and groups, ... right on shares and folders. ... shared folders on the server, and add the groups you created to the ...
      (microsoft.public.windows.server.general)
    • To disable SMB packet and secure channel signing enforcement on Windows Server 2003-based domain con
      ... It uses SMB to ... scan files to shared folders on our W2003 network. ... I can see there will be advice against having shared user folders etc on ...
      (Focus-Microsoft)
    • Re: NT workstations cant see shares on Windows 2000 server
      ... The first thing I would check is to open the Local Security Policy on both ... Windows 2000 domain controllers and make sure that they have the same ... I have no problem map to the share folders. ... >> Verify that they can ping the problem server by IP address and name. ...
      (microsoft.public.win2000.security)
    • Re: folders on top using SMB
      ... when the users access their files on the server via the smb ... wilgar> shares, folders and files are mixed. ... never presented in "server order". ...
      (alt.linux)
    • Re: Sp1 and Eval SBS 2003 Unable to Install
      ... > * Use Outlook to export the contents in the public folders to .pst files ... > partition and clean install SBS 2003 server. ... > Another way is to create a local profile, ...
      (microsoft.public.windows.server.sbs)