Reply to thread

Message

<blockquote data-quote="Andy_2639" data-source="post: 1303854" data-attributes="member: 161048">I can't connect the problem to networking. It appeared over network (with RTSP) as well as with a single-seat setup.Your SMB problems might be connected to SMB/NTLM hardening that Microsoft is currently doing. SMB version 1 shall die and AFAIK MS is automatically deinstalling it. Also replay-attack protection for NTLM is going to be enforced step-by-step IIRC.I'm most probably not affected by this because I already enabled some mitigation via Group Policies/Registry. Be aware that these settings are rather strict and need some deviations on client/server to allow SMB/RDP communication (especially ClientAllowedNTLMServers/RestrictSendingNTLMTraffic and RestrictReceivingNTLMTraffic - that's what I have to change in my network with just Windows 11 computers). I intend this more as a starting point for research which setting might cause your network to break.[CODE=ini]Windows Registry Editor Version 5.00[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0];&quot;ClientAllowedNTLMServers&quot;=hex(7):&quot;RestrictSendingNTLMTraffic&quot;=dword:00000002; https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic&quot;RestrictReceivingNTLMTraffic&quot;=dword:00000002;&quot;RestrictReceivingNTLMTraffic&quot;=dword:00000001; SMB hardening; https://support.microsoft.com/en-us/help/2345886/description-of-the-update-that-implements-extended-protection-for-auth; Client[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]&quot;SuppressExtendedProtection&quot;=dword:00000000; Server[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\Parameters];&quot;SmbServerNameHardeningLevel&quot;=dword:00000001&quot;SmbServerNameHardeningLevel&quot;=dword:00000002;&quot;SrvAllowedServerNames&quot;[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\TelnetServer\1.0]&quot;ExtendedProtection&quot;=dword:00000002[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]&quot;NoLmHash&quot;=dword:00000001; https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/active-directory-hardening-series---part-1-%e2%80%93-disabling-ntlmv1/3934787&quot;LmCompatibilityLevel&quot;=dword:00000005[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\Parameters]&quot;AutoShareWks&quot;=dword:00000000&quot;EnablePlainTextPassword&quot;=dword:00000000&quot;enablesecuritysignature&quot;=dword:00000001&quot;requiresecuritysignature&quot;=dword:00000001[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Parameters]&quot;EnablePlainTextPassword&quot;=dword:00000000&quot;EnableSecuritySignature&quot;=dword:00000001&quot;requiresecuritysignature&quot;=dword:00000001&quot;AllowInsecureGuestAuth&quot;=dword:00000000[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters]; https://support.microsoft.com/en-us/topic/2020-2023-and-2024-ldap-channel-binding-and-ldap-signing-requirements-for-windows-kb4520412-ef185fb8-00f7-167d-744c-f299a66fc00a&quot;LDAPServerIntegrity&quot;=dword:00000002&quot;LdapEnforceChannelBinding&quot;=dword:00000002[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ldap]&quot;ldapclientconfidentiality&quot;=dword:00000002; https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/active-directory-hardening-series---part-3-%E2%80%93-enforcing-ldap-signing/4066233; https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements&quot;ldapclientintegrity&quot;=dword:00000002[/CODE]</blockquote>

[QUOTE="Andy_2639, post: 1303854, member: 161048"] I can't connect the problem to networking. It appeared over network (with RTSP) as well as with a single-seat setup. Your SMB problems might be connected to SMB/NTLM hardening that Microsoft is currently doing. SMB version 1 shall die and AFAIK MS is automatically deinstalling it. Also replay-attack protection for NTLM is going to be enforced step-by-step IIRC. I'm most probably not affected by this because I already enabled some mitigation via Group Policies/Registry. Be aware that these settings are rather strict and need some deviations on client/server to allow SMB/RDP communication (especially ClientAllowedNTLMServers/RestrictSendingNTLMTraffic and RestrictReceivingNTLMTraffic - that's what I have to change in my network with just Windows 11 computers). I intend this more as a starting point for research which setting might cause your network to break. [CODE=ini]Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0] ;"ClientAllowedNTLMServers"=hex(7): "RestrictSendingNTLMTraffic"=dword:00000002 ; https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-restrict-ntlm-incoming-ntlm-traffic "RestrictReceivingNTLMTraffic"=dword:00000002 ;"RestrictReceivingNTLMTraffic"=dword:00000001 ; SMB hardening ; https://support.microsoft.com/en-us/help/2345886/description-of-the-update-that-implements-extended-protection-for-auth ; Client [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "SuppressExtendedProtection"=dword:00000000 ; Server [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\Parameters] ;"SmbServerNameHardeningLevel"=dword:00000001 "SmbServerNameHardeningLevel"=dword:00000002 ;"SrvAllowedServerNames" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\TelnetServer\1.0] "ExtendedProtection"=dword:00000002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "NoLmHash"=dword:00000001 ; https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/active-directory-hardening-series---part-1-%e2%80%93-disabling-ntlmv1/3934787 "LmCompatibilityLevel"=dword:00000005 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\Parameters] "AutoShareWks"=dword:00000000 "EnablePlainTextPassword"=dword:00000000 "enablesecuritysignature"=dword:00000001 "requiresecuritysignature"=dword:00000001 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Parameters] "EnablePlainTextPassword"=dword:00000000 "EnableSecuritySignature"=dword:00000001 "requiresecuritysignature"=dword:00000001 "AllowInsecureGuestAuth"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters] ; https://support.microsoft.com/en-us/topic/2020-2023-and-2024-ldap-channel-binding-and-ldap-signing-requirements-for-windows-kb4520412-ef185fb8-00f7-167d-744c-f299a66fc00a "LDAPServerIntegrity"=dword:00000002 "LdapEnforceChannelBinding"=dword:00000002 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ldap] "ldapclientconfidentiality"=dword:00000002 ; https://techcommunity.microsoft.com/blog/coreinfrastructureandsecurityblog/active-directory-hardening-series---part-3-%E2%80%93-enforcing-ldap-signing/4066233 ; https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/network-security-ldap-client-signing-requirements "ldapclientintegrity"=dword:00000002 [/CODE] [/QUOTE]

Verification