Windows Server 2022 — SMB Access Denied After NTLM Hardening Policy Change — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Quick Checks
3. Deep Diagnosis
4. Primary Fix
5. Verification
6. Prevention & Hardening

Symptom & Impact

Users and service accounts lose access to shared folders after security baseline changes disable legacy auth flows. Applications using old SMB clients receive Access Denied even with correct credentials. File-dependent workloads fail intermittently across departments.

Quick Checks

Review SMB server config, signing settings, and active policy application on file servers.

Get-SmbServerConfiguration | Select EnableSMB1Protocol,RequireSecuritySignature,EnableSecuritySignature
gpresult /h C:Tempgp.html
Get-ItemProperty 'HKLM:SYSTEMCurrentControlSetControlLsa'

Deep Diagnosis

Inspect failed logons for NTLM restrictions and confirm SPN/Kerberos viability for affected service paths.

Get-WinEvent -LogName Security -MaxEvents 200 | Where-Object {$_.Id -in 4625,4776}
klist
setspn -Q cifs/filesrv01.contoso.local

Primary Fix

Align policy to allow required auth path temporarily while migrating clients to Kerberos-compatible configuration.

Set-SmbServerConfiguration -RejectUnencryptedAccess $true -Force
Set-ItemProperty 'HKLM:SYSTEMCurrentControlSetControlLsaMSV1_0' -Name RestrictReceivingNTLMTraffic -Value 1
Restart-Service LanmanServer

Verification

Authenticated SMB sessions should establish successfully for approved users and service principals.

Test-Path \filesrv01finance$
Get-SmbSession | Select ClientComputerName,UserName,Dialect
Get-WinEvent -LogName Security -MaxEvents 50 | Where-Object {$_.Id -eq 4624}

Prevention & Hardening

Phase NTLM restrictions with inventory, exception control, and mandatory SMB signing/encryption where possible.

Get-SmbConnection
Get-SmbServerConfiguration
AuditPol /get /subcategory:'Credential Validation'