Suppose that I have two Windows 10 (Professional edition) computers, one (PC) sharing a folder and second one (notebook) copying data to the shared folder automatically. I would like to prevent notebook from copying the data to unknown/fake servers accepting any passwords/credentials. Is there some security in the protocol (SMB version 3.1.1, possibly with encryption enabled) with regards to verifying endpoint identity or preventing using a fake server, when it does not know the user name and password pair?
1 Answer
Unfortunately, this is not possible in your situation.
When you want the client and the server both to verify each other's identity, this is called "mutual authentication".
Per this MSDN post, NTLM does not support mutual authentication. (It's the third bullet point in the NTLM SessionKey section.)
Kerberos supports mutual authentication, but you must setup a Windows domain to use Kerberos authentication. This requires a Windows Server OS.
After that, the client must be configured to require mutual authentication once both systems are joined to the domain---mutual authentication is not required by default even when it is available.
