Public/Enable-SmbSigning.ps1
|
function Enable-SmbSigning { <# .SYNOPSIS Enforces SMB signing on the LanManWorkstation service. .DESCRIPTION Sets the RequireSecuritySignature DWORD value to 1 under the LanManWorkstation parameters registry key, requiring SMB clients to sign all communications. Changes apply to new SMB connections; existing sessions are unaffected until reconnected. .INPUTS None. Parameters must be supplied directly. .OUTPUTS None. .PARAMETER ComputerName The target computer. Defaults to the local machine. .EXAMPLE Enable-SmbSigning Enforces SMB signing on the local machine. .EXAMPLE Enable-SmbSigning -ComputerName 'Server01' Enforces SMB signing on Server01. .NOTES Requires Administrator privileges. Remote operations require WinRM to be configured on the target machine. #> [CmdletBinding(SupportsShouldProcess, ConfirmImpact = 'Medium')] [OutputType([void])] param ( [Parameter(Mandatory = $false)] [string]$ComputerName = $env:COMPUTERNAME ) $isLocal = ($ComputerName -ieq $env:COMPUTERNAME) -or ($ComputerName -ieq 'localhost') -or ($ComputerName -eq '127.0.0.1') $registryPath = 'HKLM:\System\CurrentControlSet\Services\LanManWorkstation\Parameters' $valueName = 'RequireSecuritySignature' if ($PSCmdlet.ShouldProcess($ComputerName, "Set $valueName = 1 on LanManWorkstation")) { if ($isLocal) { $current = (Get-ItemProperty -Path $registryPath -ErrorAction Stop).$valueName if ($current -eq 1) { Write-Verbose "SMB signing is already enforced on '$ComputerName'. No changes made." return } Set-ItemProperty -Path $registryPath -Name $valueName -Value 1 -ErrorAction Stop Write-Verbose "SMB signing enforced on '$ComputerName'." } else { Invoke-Command -ComputerName $ComputerName -ScriptBlock { $regPath = $using:registryPath $valName = $using:valueName $current = (Get-ItemProperty -Path $regPath -ErrorAction Stop).$valName if ($current -eq 1) { Write-Verbose "SMB signing is already enforced. No changes made." return } Set-ItemProperty -Path $regPath -Name $valName -Value 1 -ErrorAction Stop } Write-Verbose "SMB signing enforced on '$ComputerName'." } } } |