Re: To disable SMB packet and secure channel signing enforcement on Windows Server 2003-based domain controllers

From: Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] (sbradcpa_at_pacbell.net)
Date: 05/10/05

  • Next message: Zack Schiel: "Encrypting remote files with EFS" 
    Date: Mon, 09 May 2005 16:41:40 -0700
To: Wes Johns <wesleyj@microsoft.com>

    Printer/Scanner/Copier shopping during the last week......

    Ricoh copier/printer/scanner .... to be leased in the near future and
    thus a brand new machine and getting the technical details.....the guy
    tells me the following....

    "You cannot do smb to a Windows 2003 server, we have issues with
    that..you can however, smb scan to a XP machine"

    "This is a 2004 model and we didn't anticpate the Server 2003 security
    requirements" [that was my personal favorite]

    "We'll have a version of the Ricoh that handles SMB on the Windows 2003
    server in about a month"

    Konica does only does FTP and does not do SMB....

    You were saying about 'go to those vendors and demand'? They don't even
    have the equipment that supports it.

    Susan

    Wes Johns wrote:

    >The client states how it can connect and then the least common
    >denominator is used. By turning smb signing off you are also open to
    >session hijacking. So one could steal your session to a file server and
    >access files using your account.
    >
    >Thank You
    >Wesley Johns MCSE:Security, CEH, CISSP, ISSAP
    >Microsoft Consulting Services
    >Phone 214-458-5551
    >Email: Wesleyj@microsoft.com
    >IM: Wesley_johns@hotmail.com
    >
    >-----Original Message-----
    >From: Free, Bob [mailto:RWF4@pge.com]
    >Sent: Thursday, May 05, 2005 10:51 AM
    >To: focus-ms@securityfocus.com
    >Cc: Murad Talukdar
    >Subject: RE: To disable SMB packet and secure channel signing
    >enforcement on Windows Server 2003-based domain controllers
    >
    > > how does it 'decide' when it should communicate insecurely
    >
    > Murad-
    >
    >In his own inimitable way Mark Minasi had a very nice little write-up on
    >this very subject in his mid-April newsletter(#46) he entitled "How SMB
    >Signing Works: An "Alcoholics Anonymous" Protocol"
    >You could sign up to see the archive at
    >http://www.minasi.com/archive.htm
    >I found it to be an intriguing presentation of the subject so I saved so
    >I saved that portion off as a separate doc. I'll send you a copy.
    >
    >-----Original Message-----
    >From: Murad Talukdar [mailto:talukdar_m@subway.com]
    >Sent: Wednesday, May 04, 2005 8:26 PM
    >To: '?????? ??????'
    >Cc: focus-ms@securityfocus.com
    >Subject: RE: To disable SMB packet and secure channel signing
    >enforcement on Windows Server 2003-based domain controllers
    >
    >Excellent. This is now working according to Laura's/????? ?????
    >settings.
    >Thanks to everyone. I've learnt a lot from this single issue.
    >One last question, with the whenever possible option. According to ?????
    >?????, the DCs will now communicate insecurely with my printer, but does
    >this mean it would communicate insecurely with some 'unknown' machine
    >too.
    >What I'm trying to work out, I guess, is how does it 'decide' when it
    >should
    >communicate insecurely--what test does it carry out? Is it treating the
    >scanner as a member server or a client?
    >As the whole worry here is MITM's --are there ones which could be
    >utilized
    >now that I have set the network server to digitally sign always but the
    >clients and the members to do it whenever possible?
    >I'm thinking the risk is greatly reduced but is it removed 'completely'?
    >
    >Murad
    >-----Original Message-----
    >From: ?????? ?????? [mailto:morsin@eastbridge.tula.ru]
    >Sent: Wednesday, May 04, 2005 10:52 PM
    >To: Murad Talukdar
    >Subject: Re: To disable SMB packet and secure channel signing
    >enforcement on
    >Windows Server 2003-based domain controllers
    >
    >
    >----- Original Message -----
    >
    >
    >>1. From Administrative Tools open Domain Controller Security Policy 2.
    >>
    >>
    >
    >
    >
    >>Smile
    >>3. Select \Security Settings\Local Policies\Security Options folder.
    >>
    >>
    >4. In
    >
    >
    >>the details pane, double-click Microsoft network server: Digitally
    >>
    >>
    >sign
    >
    >
    >>communications (always), and then click Disabled to prevent SMB packet
    >>signing from being required. 5. Click OK. 6. In the details pane,
    >>double-click Domain member: Digitally encrypt or sign secure channel
    >>
    >>
    >data
    >
    >
    >>(always), and then click Disabled to prevent secure channel signing
    >>
    >>
    >from
    >
    >
    >>being required. 7. Click OK.
    >>
    >>
    >
    >1. Return back to "Enabled" secure channel ecnryption requirement. SMB
    >file
    >sharing has nothing to do woth it. Secure Channel is used by domain
    >member
    >computers to pass user authentication information to DCs.
    >2. There are companion settings "Digitally sign communications (always)"
    >and
    >
    >"Digitally sign communications (when possible)" for both servers and
    >workstations. Set first to "Disabled" and second to "Enabled" and your
    >DCs
    >will communicate securely with users and insecurely with your printer.
    >
    >
    >
    >
    >
    >------------------------------------------------------------------------
    >---
    >------------------------------------------------------------------------
    >---
    >
    >
    >
    >------------------------------------------------------------------------
    >---
    >------------------------------------------------------------------------
    >---
    >
    >
    >---------------------------------------------------------------------------
    >---------------------------------------------------------------------------
    >
    >
    >
    > 

    -- 
Dear Mr. Aitel: 
http://msmvps.com/bradley/archive/2005/04/13/42009.aspx
---------------------------------------------------------------------------
---------------------------------------------------------------------------
  • Next message: Zack Schiel: "Encrypting remote files with EFS"

    Relevant Pages

    • RE: SBS2k prep for w2k3
      ... To prepare a Windows 2000 forest to host new or upgraded Windows Server ... host Windows Server 2003 domain controllers. ... | What preperations to my existing sbs2k domain do I need to do in order to ...
      (microsoft.public.backoffice.smallbiz2000)
    • Re: Move DC from Windows 2003 to Windows 2008
      ... The set up we have is a 2-node Windows Server 2003 cluster, with both nodes as domain controllers and running clustered SQL Server 2003. ... find a simple step by step guide for the process. ...
      (microsoft.public.windows.server.general)
    • RE: To disable SMB packet and secure channel signing enforcement on Windows Server 2003-based domain
      ... To disable SMB packet and secure channel signing enforcement on ... Windows Server 2003-based domain controllers ... >enforcement on Windows Server 2003-based domain controllers ...
      (Focus-Microsoft)
    • Re: Raise Domain Functional Level
      ... I would suspect Exchange Server 2003? ... Are all of your Domain Controllers running Windows Server 2003? ...
      (microsoft.public.windows.server.active_directory)
    • Re: SMB on Win2k3 DC - Turn Off and Disable ? Help or Advice
      ... Also make sure that Sites and Services are properly configured and that you have a local GC for each site, the clients should use their LOCAL DNS server as well. ... SMB on Domain Controllers will help resolve the problem!! ... Will it help with a performance problem? ...
      (microsoft.public.windows.server.active_directory)