SMB signing was enabled by default in Windows 11 Insider Enterprise editions recently, causing some failures. Microsoft now has a workaround.
Over a year ago, Microsoft announced that it will no longer ship Windows 11 Home with Server Message Block version 1 (SMB1), since it is a very old network security protocol that has been considered insecure for some time and has been succeeded by newer iterations. That said, SMB is still present in Windows 11, and in fact, the company made SMB signing the default behavior in Windows Insider Enterprise builds earlier this month. However, Microsoft has learned that SMB authentication is failing in certain scenarios, and as such, it has now offered a workaround for the issue.
Essentially, SMB authentication in Windows 11 Insider builds is not working for guest logons anymore because SMB signing fails when you are utilizing guest authentication. The key used to generate a signature for a message that is being sent is derived from the user’s password. When you enable guest authentication, there is no password, which means that the two concepts are mutually exclusive, you can’t have both. Since there is no user password available to create a signature, Windows currently just fails the SMB connection for a guest client since SMB signing – which requires a password – is now enabled by default in certain Windows Insider builds.
It is important to note that this isn’t exactly a radical change in behavior. Microsoft stopped allowing guest logons by default back in Windows 2000, stopped built-in Guest accounts from connecting remotely to Windows, and even disabled SMB2 and SMB3 guest access starting with Windows 10 version 1709.
