Server Message Block communication between a client-side SMB component and a server-side SMB component is not completed if the SMB signing settings are mismatched in Group Policy or in the registry (916846)

RESOLUTION

Update information

The following files are available for download from the Microsoft Download Center:

Update for Windows XP, x64-based versions

Download the 916846 package now.

Release Date: August 15, 2006

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base:

119591 How to obtain Microsoft support files from online services

Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Prerequisites

No prerequisites are required.

Restart requirement

You must restart the computer after you apply this update.

Note This update supports hotpatching on computers that are running the x86 version of Microsoft Windows Server 2003 Service Pack 1 (SP1) if the following conditions are true:

The file version of the Srv.sys file that is installed on the computer is either 5.2.3790.2437 or 5.2.3790.2691.
The file version of the Mrxsmb.sys file that is installed on the computer is either 5.2.3790.1830 or 5.2.3790.2697.

You do not have to restart the Windows Server 2003 SP1-based computer if you use hotpatching to install the update.

Update replacement information

This update does not replace any other updates.

MORE INFORMATION

All communications that use the SMB protocol can be digitally signed at the packet level by using the SMB signing feature. By digitally signing the packets, the recipient of the packets can confirm the point of origination and authenticity of the packets. The message authentication negotiation occurs during the protocol negotiation and user validation phase. The SMB signing feature is completely configurable in Windows registry and in Group Policy for the server-side SMB component and for the client-side SMB component.

The following table describes the Group Policy settings and the corresponding registry values that you use to determine the settings for SMB signing on the client side and on the server side.

Group Policy setting	Corresponding registry value
Microsoft network client: Digitally sign communications (if server agrees)	`HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lanmanworkstation\Parameters\Enablesecuritysignature`
Microsoft network client: Digitally sign communications (always)	`HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lanmanworkstation\Parameters\Requiresecuritysignature`
Microsoft network server: Digitally sign communications (if server agrees)	`HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lanmanserver\Parameters\Enablesecuritysignature`
Microsoft network server: Digitally sign communications (always)	`HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lanmanserver\Parameters\Requiresecuritysignature`

SMB signing configuration on the client side

SMB signing is disabled on the client side if the following conditions are true:

The value of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lanmanworkstation\Parameters\Enablesecuritysignature registry entry is set to 0, or if the corresponding Group Policy setting is disabled.
The value of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lanmanworkstation\Parameters\Requiresecuritysignature registry entry is set to 0, or if the corresponding Group Policy setting is disabled.

SMB signing is enabled on the client side if the following conditions are true:

The value of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lanmanworkstation\Parameters\Enablesecuritysignature registry entry is set to 1, or if the corresponding Group Policy setting is enabled.
The value of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lanmanworkstation\Parameters\Requiresecuritysignature registry entry is set to 0, or if the corresponding Group Policy setting is disabled.

SMB signing is required on the client side if the value of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lanmanworkstation\Parameters\Requiresecuritysignature registry entry is set to 1, or if the corresponding Group Policy setting is enabled.

SMB signing configuration on the server side

SMB signing is disabled on the server side if the following conditions are true:

The value of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lanmanserver\Parameters\Enablesecuritysignature registry entry is set to 0, or if the corresponding Group Policy setting is disabled.
The value of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lanmanserver\Parameters\Requiresecuritysignature registry entry is set to 0, or if the corresponding Group Policy setting is disabled.

SMB signing is enabled on the server side if the following conditions are true:

The HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lanmanserver\Parameters\Enablesecuritysignature registry value is set to 1, or if the corresponding Group Policy setting is enabled.
The HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lanmanserver\Parameters\Requiresecuritysignature registry value is set to 0, or if the corresponding Group Policy setting is disabled.

SMB signing is required on the server side if the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Lanmanserver\Parameters\Requiresecuritysignature registry value is set to 1, or if the corresponding Group Policy setting is enabled.

The update will change the behavior of the settings. These changes are described in the following Interoperability matrix for SMB signing.

Interoperability matrix (graphic version)
Interoperability matrix part 1

Interoperability matrix (text version)

						Server
			Patched	Patched	Patched	Unpatched	Unpatched	Unpatched
			Required	Enabled	Disabled	Required	Enabled	Disabled
	Patched	Required	Signed	Signed	Signed	Signed	Signed	No communication
*Client*	Patched	Enabled	Signed	Signed	Not signed	Signed	Signed	Not signed
	Patched	Disabled	Signed	Not signed	Not signed	Signed	Not signed	Not signed
	Unpatched	Required	Signed	Signed	No communication	Signed	Signed	No communication
	Unpatched	Enabled	Signed	Signed	Not signed	Signed	Signed	Not signed
	Unpatched	Disabled	No communication	Not signed	Not signed	No communication	Not signed	Not signed

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

823659 Client, service, and program incompatibilities that may occur when you modify security settings and user rights assignments

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

839499 You cannot open file shares or Group Policy snap-ins when you disable SMB signing for the Workstation or Server service on a domain controller

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

897341 How to use HotPatching to install security updates for Windows Server 2003 Service Pack 1

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

824684 Description of the standard terminology that is used to describe Microsoft software updates

Server Message Block communication between a client-side SMB component and a server-side SMB component is not completed if the SMB signing settings are mismatched in Group Policy or in the registry (916846)

SYMPTOMS

CAUSE

RESOLUTION

Update information

Update for Windows Server 2003, x86-based versions

Update for Windows Server 2003, x64-based versions

Update for Windows Server 2003, Itanium-based versions

Update for Windows XP, x86-based versions

Update for Windows XP, x64-based versions

Prerequisites

Restart requirement

Update replacement information

STATUS

MORE INFORMATION

SMB signing configuration on the client side

SMB signing configuration on the server side