Tools · Active Directory defense · 08 / 23
Defending against NTLM relay: SMB signing, LDAP signing, channel binding, and EPA
Understand relay at a conceptual level and turn on the server-side protections that make relayed authentication useless.
Relay in one paragraph
In a relay, an attacker on the network induces a victim machine to authenticate to them, for example through name resolution poisoning or by coercing a server to connect. Instead of cracking the response, the attacker forwards it to a different server, which accepts it as the victim. The result is access to that server as the victim, without ever learning a password.
The defense is to make servers require proof that the authentication was meant for them and that the session is protected. That is what signing, channel binding, and Extended Protection provide.
The protections
SMB signing required on servers stops relayed SMB sessions. LDAP signing required and LDAP channel binding on domain controllers stop relays to LDAP and LDAPS, which otherwise allow changing directory objects. Extended Protection for Authentication on IIS, Exchange, and AD CS web enrollment ties authentication to the TLS channel. Disabling LLMNR and NetBIOS name resolution removes the most common way victims are induced to authenticate.
On domain controllers, Directory Service Event 2889 lists clients performing unsigned LDAP binds once diagnostic logging is raised, which shows what would break.
Get-SmbServerConfiguration | Select RequireSecuritySignature, EnableSecuritySignature
Set-SmbServerConfiguration -RequireSecuritySignature $true -Force
# DC: log unsigned binds (Event 2889)
reg add HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics /v "16 LDAP Interface Events" /t REG_DWORD /d 2 /f
Get-WinEvent -FilterHashtable @{LogName='Directory Service'; Id=2889} -MaxEvents 20Lab: turn them on and verify
In the lab, check SMB signing on the member server with Nmap’s smb2-security-mode, then require it via Group Policy and rescan. On the DC, set “Domain controller: LDAP server signing requirements” to Require signing and LdapEnforceChannelBinding to 2, after checking 2889 events show no clients that would break. Disable LLMNR with the GPO “Turn off multicast name resolution”.
Record before and after for each control. That evidence is useful when explaining the change to application owners.
reg add HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Parameters /v LdapEnforceChannelBinding /t REG_DWORD /d 2 /f # GPO: Computer Configuration > Administrative Templates > Network > DNS Client > Turn off multicast name resolution = Enabled nmap -p445 --script smb2-security-mode 192.168.56.11
Coercion and AD CS
Several techniques coerce a server, including a DC, to authenticate to an attacker host. Patching, disabling the Print Spooler on DCs, and restricting outbound SMB from servers reduce them. AD CS web enrollment endpoints without EPA have been a prominent relay target; enable EPA and require HTTPS, or remove web enrollment if unused.
Newer Windows Server releases enable more of these protections by default. Verify the effective settings rather than assuming.
Diagram
Relay targets and their protection
Each protocol has its own switch.
- SMB
Require SMB signing on servers and clients.
- LDAP / LDAPS
Require LDAP signing and channel binding on DCs.
- HTTP (IIS, AD CS, Exchange)
Enable Extended Protection for Authentication and HTTPS.
- Name resolution
Disable LLMNR and NetBIOS over TCP/IP.
Check yourself
1. What does an NTLM relay attacker need to learn?
2. Which DC event lists clients doing unsigned LDAP binds?
3. Which setting removes a common way victims are tricked into authenticating?