To prevent domain controllers from requiring SMB signing

1. Open Active Directory Users and Computers.
2. In the console tree, right-click Domain Controllers, click Properties, and then click the Group Policy tab.
3. Click Default Domain Controllers Policy, and then click Edit.
4. Under Security Options right-click Microsoft network server: Digitally sign communications (always), click Properties, and then click Disabled.

   Where?

   • Computer Configuration
   • Windows Settings
   • Security Settings
   • Local Policies
   • Security Options

Caution

• By disabling this security setting, you expose all domain controller communications to man-in-the-middle attacks. Therefore, it is highly recommended that you upgrade your clients rather than disable this security setting. The Active Directory client, which is required for Windows 95 clients to perform Server Message Block (SMB) signing, can be obtained from the \clients\win9x subdirectory of the Windows 2000 Server CD.

Related Topics