I have a computer (Windows) on a network where an industrial process is controlled. There is an option in Local Security Policy >> Local Policies >> Security Options >> "Microsoft network client: Digitally sign communications (always)".

By default, this option should be Disabled on Windows machines but all computers that we receive from the vendor has this feature Enabled, so I can only assume that it is intentional. In order to backup to a NAS, I had to disable this feature.

My question is what might the security concerns be considering that this machine is on a local network where an industrial process is being controlled. From Microsoft's website, I get the impression that it prevents man-in-the-middle attacks that modify SMB packets. Is this the full story?


Indeed, Microsoft Technet lists MITM prevention as the sole use of this setting. And a digital signature does just that: to prove the authenticity of a digital message. If your network is trusted and MITM scenarios are really (!) not possible, it can be disabled.

Apparently there's also a performance decrease involved when it's enabled. So, if you're disabling it for performance reasons: you're trading performance for security.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.