Windows 11 24H2 & Server 2025: SMB signing, NAS problems and legacy shares
Windows 11 24H2 and Windows Server 2025 significantly strengthen SMB security. In particular, SMB signing is required by default for outbound connections in relevant configurations, which can expose compatibility problems with older NAS devices and third-party SMB servers.
What SMB signing does
SMB signing protects message integrity. An attacker cannot silently alter signed SMB traffic without causing signature validation to fail.
Why old NAS devices suddenly fail
Legacy NAS and embedded Samba versions may not support the required signing behaviour. If the client requires signing and the server cannot provide it, the connection fails.
First diagnostic commands
Use `Get-SmbClientConfiguration` and `Get-SmbServerConfiguration` to inspect local SMB settings.
Get-SmbClientConfiguration
Get-SmbServerConfiguration
Get-SmbConnectionInspect active shares
`Get-SmbConnection` shows active SMB connections. `net use` is also useful for classic Windows share troubleshooting.
Do not disable signing too quickly
Disabling signing may restore access temporarily but weakens security. Updating the server or replacing an obsolete device is preferable.
SMB1 is not a repair strategy
Do not re-enable SMB1 as a generic fix. A device that only supports SMB1 is a strong modernization signal.
IP address or DNS name?
For Kerberos and clean SMB security, use proper DNS names rather than connecting to shares by IP address.
Samba and Linux NAS
Review the Samba configuration deliberately. Avoid enabling broad legacy compatibility settings just to make one old client work.
Troubleshooting checklist
Check Windows version, inspect SMB configuration, list active connections, identify the remote server, check its SMB capabilities, inspect logs and only then make a targeted change.
Conclusion
SMB signing is a security improvement, not an arbitrary nuisance. The long-term fix is normally modernization of the remote server rather than weakening the client.