NTLM Relay Defense Notes: Signing, EPA, and SMB/LDAP Controls

This is a signing-and-binding lab, not a relay walkthrough. Target is a lab domain with two members: ws01 and dc01. Goal: dump the SMB and LDAP signing settings as they exist in registry/GPO, name the Wireshark fields I use to see whether a session required MIC / signing / channel binding, and keep a 4625 failed-auth. I do not run a listener that forwards Net-NTLM to LDAP or SMB. No ntlmrelayx, no PetitPotam command line, no coerce-and-relay one-liner.

1Figure 1. Relay needs a target that accepts unbound NTLM. Signing and EPA remove that target.
2SMB RequireSecuritySignature=1
3LDAP LDAPServerIntegrity=2 + LdapEnforceChannelBinding=2
4IIS  tokenChecking=Require

Lab layout

1labs/ntlm_lab/
2  smb-sign.reg.txt
3  ldap-sign.gpo.txt
4  epa-iis.txt
5  pcap-fields.txt     # Wireshark display filter names, no pcap attached

Artifact: signing settings, as the machine has them

SMB (LanmanWorkstation / LanmanServer):

1C:\lab> reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v RequireSecuritySignature
2    RequireSecuritySignature    REG_DWORD    0x1
3
4C:\lab> reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters /v RequireSecuritySignature
5    RequireSecuritySignature    REG_DWORD    0x1
6
7C:\lab> reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v EnableSecuritySignature
8    EnableSecuritySignature    REG_DWORD    0x1

Require*=1 is “required”, not “if partner agrees”. Enable* without Require* is the historical “negotiated” mode that still loses to a downgrade. I file Enable-without-Require as not done.

LDAP (DC):

1# GPO: Computer Config → Policies → Windows Settings → Security Settings
2#       → Local Policies → Security Options
3# "Domain controller: LDAP server signing requirements" = Require signing
4
5C:\lab> reg query HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters /v LDAPServerIntegrity
6    LDAPServerIntegrity    REG_DWORD    0x2
7# 0 = none, 1 = negotiated, 2 = required

LDAP channel binding (EPA analog for AD):

1C:\lab> reg query HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters /v LdapEnforceChannelBinding
2    LdapEnforceChannelBinding    REG_DWORD    0x2
3# 0 off, 1 when-supported, 2 required

IIS EPA (loopback lab site):

1# %windir%\system32\inetsrv\config\applicationHost.config excerpt
2<windowsAuthentication enabled="true" useKernelMode="true">
3  <extendedProtection tokenChecking="Require" />
4</windowsAuthentication>

tokenChecking="Require" is the setting. Allow is the half-measure.

Wireshark field names (no relay capture)

I generate a direct SMB session from ws01 to dc01 as labuser (not via a third host). Filters I actually use:

1ntlmssp.messagetype == 3                 # AUTHENTICATE
2ntlmssp.ntlmv2_response.ntproofstr
3ntlmssp.version
4ntlmssp.auth.mic                         # present when MIC computed
5smb2.flags.signed == 1
6smb2.sesid
7ldap.extendedResult                      # LDAP
8gss-api
9tls.handshake.extensions.pre_shared_key  # not NTLM; do not mix

Direct session excerpt (text from the packet list, secrets redacted):

 1# frame 18  ws01 → dc01  SMB2 Session Setup Request
 2ntlmssp.messagetype                  3 (NTLMSSP_AUTH)
 3ntlmssp.auth.domain                  LAB
 4ntlmssp.auth.username                labuser
 5ntlmssp.auth.hostname                WS01
 6ntlmssp.auth.mic                     [REDACTED 16 bytes]
 7smb2.flags.signed                    True
 8
 9# frame 19  dc01 → ws01  Session Setup Response
10smb2.nt.status                       STATUS_SUCCESS
11smb2.flags.signed                    True

MIC present + SMB2 signed is what I want. A capture against a server with RequireSecuritySignature=0 shows smb2.flags.signed == False after setup. That server is a relay target in the abstract. I still do not introduce a third host to prove it.

LDAP over TLS (LDAPS) with channel binding: the CBT is derived from the TLS Finished, not something I print. Wireshark:

1tls.handshake.certificate            CN=dc01.[REDACTED]
2ldap.messageID                       1 bindRequest
3ntlmssp.messagetype                  3
4# LdapEnforceChannelBinding=2  → bind succeeds only if CBT matches this TLS

Failed bind when I used LDAP without TLS toward a DC that requires signing:

1ldap.result.code                     8  (strongerAuthRequired)
2# Windows event 2889 / 2886 on older DCs; on this lab:
3#  "The following client did not use signing"
4#  User: LAB\labuser  IP: 10.[REDACTED]

Analysis: what relay needs, as a checklist I break

Conceptually (ASCII only, no tool):

1victim --NTLM-->  ???  --NTLM-->  target SMB/LDAP/HTTP
2                     ^
3                     not in this lab

Break legs:

Victim never authenticates to a host you do not trust (SMB signing on clients helps less than people think; coercion is a different ticket).
Target requires signing (SMB RequireSecuritySignature=1, LDAP LDAPServerIntegrity=2).
Target requires channel binding (LDAP LdapEnforceChannelBinding=2, IIS EPA Require).
Target account cannot be used for the interesting operation (delegation, ACE). That is identity, not NTLM.

I tick 2 and 3 in this notebook. I do not tick 1 by running a coerce.

Sanitized reproduction (failed auth only)

Wrong password, NTLM to the lab share, signing required:

 1C:\lab> net use \\dc01.lab.internal\lab$ /user:LAB\labuser WrongPass
 2System error 1326 has occurred.
 3The user name or password is incorrect.
 4
 5# Event 4625 on dc01
 6Logon Type:                 3
 7Security ID:                S-1-0-0
 8Account Name:               labuser
 9Account Domain:             LAB
10Failure Reason:             %%2313   Unknown user name or bad password
11Source Network Address:     10.[REDACTED]
12Authentication Package:     NTLM
13Key Length:                 0

Key Length: 0 on a failure is normal. On a success 4624 type 3 with NTLM and key length 0 plus unsigned SMB is the hunting row. I do not produce a successful relayed 4624.

A client with signing required talking to a test server I set to RequireSecuritySignature=0 and EnableSecuritySignature=0 (lab VM, then reverted):

1System error 53 / 1240  (varies)
2# workstation log:
3# "The server is unwilling to negotiate signing"
4# I reverted RequireSecuritySignature=1 on the test server immediately.

That connection failure is the control working from the client side. It is not a relay.

HTTP EPA vs SMB signing (do not mix the tickets)

A web app with Windows auth can still be a relay target when EPA is None, even if SMB signing is required everywhere. I dump IIS and WinRM separately:

1C:\lab> winrm get winrm/config/service
2    Auth
3        Kerberos = true
4        Negotiate = true
5        Certificate = false
6        CbtHardeningLevel = Strict

CbtHardeningLevel = Strict is the WinRM analog of IIS tokenChecking=Require. Relaxed is the finding.

IIS site that still has tokenChecking="None":

1# lab copy I then fixed
2<extendedProtection tokenChecking="None" />
3# file: EPA off on Default Web Site — ticket, then set Require

SMB, LDAP, HTTP, WinRM are four checkboxes. Signing on SMB does not set EPA on IIS.

Mitigation (GPO language I paste into the change ticket)

1Microsoft network server: Digitally sign communications (always)          = Enabled
2Microsoft network client: Digitally sign communications (always)          = Enabled
3Domain controller: LDAP server signing requirements                       = Require signing
4Domain controller: LDAP server channel binding token requirements         = Always
5Network security: Restrict NTLM: Incoming NTLM traffic                    = Deny all accounts (after audit)
6Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers  = Deny all (after audit)
7IIS: windowsAuthentication/extendedProtection/tokenChecking               = Require

Audit first (Audit incoming NTLM / Audit NTLM authentication in this domain), then deny. I keep 8004 events during the audit window; I do not keep a relay proof.

SMB3 + encryption (RejectUnencryptedAccess) is stronger than signing for data in flight. Signing is the relay-relevant bit. Encryption without required signing still needs the EPA/LDAP binding checkboxes; they are not substitutes for each other. After the GPO, I re-dump the four registry values and keep the before/after in the change ticket. gpresult /h gp.html on ws01 and dc01 is the evidence the setting actually applied, not that the GPO object exists in SYSVOL. I archive the HTML with the change ticket.

What I file after this lab

SMB server+client RequireSecuritySignature=0x1
NTDS LDAPServerIntegrity=0x2, LdapEnforceChannelBinding=0x2
IIS EPA tokenChecking=Require
Direct SMB: ntlmssp.auth.mic present, smb2.flags.signed=True, user labuser, host WS01
Unsigned LDAP bind: result code 8 strongerAuthRequired
4625 type 3 NTLM bad password, address [REDACTED]
Out of scope: any command line that starts a relay listener or a coerce

Commands appendix

1reg query HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters /v RequireSecuritySignature
2reg query HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters /v LDAPServerIntegrity
3reg query HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters /v LdapEnforceChannelBinding
4# Wireshark display filter:
5# ntlmssp.messagetype == 3 && smb2.flags.signed

Lab layout#

Artifact: signing settings, as the machine has them#

Wireshark field names (no relay capture)#

Analysis: what relay needs, as a checklist I break#

Sanitized reproduction (failed auth only)#

HTTP EPA vs SMB signing (do not mix the tickets)#

Mitigation (GPO language I paste into the change ticket)#

What I file after this lab#

Commands appendix#