Disable: 'Microsoft network server: Server SPN target name validation level' for SMBServerNameHardeningLevel This policy setting controls the level of validation a computer with shared folders or printers (the server) performs on the service principal name (SPN) that is provided by the client computer when it establishes a session using the server message block (SMB) protocol. The server message block (SMB) protocol provides the basis for file and print sharing and other networking operations, such as remote Windows administration. The SMB protocol supports validating the SMB server service principal name (SPN) within the authentication blob provided by a SMB client to prevent a class of attacks against SMB servers referred to as SMB relay attacks. This setting will affect both SMB1 and SMB2. This security setting determines the level of validation a SMB server performs on the service principal name (SPN) provided by the SMB client when trying to establish a session to an SMB server. Counter Measure: Configuring this setting to accept or require that a connecting client send a SPN during session setup helps ensure that authorized clients are the only ones connecting to a resource. Potential Impact: Windows operating systems support both a client-side SMB component and a server-side SMB component. This setting affects the server SMB behavior, and its implementation should be carefully evaluated and tested to prevent disruptions to file and print serving capabilities.

[off (disable)/accept if provided by client/required from client]

(1) GPO: Computer ConfigurationWindows SettingsSecurity SettingsLocal PoliciesSecurity OptionsMicrosoft network server: Server SPN target name validation level (2) REG: HKEY_LOCAL_MACHINESystemCurrentControlSetServicesLanManServerParametersSMBServerNameHardeningLevel