Newshot Windows NTLM Security Mechanism Adjustment: Microsoft Plans to Reject Unsigned Connections Starting May 2027 to Reduce Relay Attack Risk
IT之家 November 12 news, Microsoft officially announced that starting today, it will gradually strengthen the NTLM authentication security mechanism through Windows updates, requiring Windows clients to provide NTLM message signing in all connections by default, in order to reduce the risk of man-in-the-middle attacks and NTLM relay attacks.
Microsoft stated that this adjustment will be carried out in two phases. The second phase will start in May 2027, at which point Windows Server will enforce NTLM signing for clients by default, and clients that do not provide signing will be rejected.
According to Microsoft's newly released KB5135557 support document, this security improvement aims to fix the security vulnerability numbered CVE-2026-118737 and is also the first phase of Microsoft's improvements to the NTLM message signing mechanism.
IT之家 note: NTLM is a network authentication protocol that Windows systems have used for a long time.
Microsoft pointed out that NTLM has two signing modes: one is true cryptographic message signing, which can establish a session key and provide cryptographic protection; the other is the traditional ALWAYS_SIGN placeholder mechanism, which generates 16 bytes of data but does not provide true cryptographic protection.
Microsoft previously found that some applications do not request security context requirements such as integrity checks, causing the system to possibly adopt the traditional signing mode that lacks actual cryptographic protection. This update will further ensure that authenticated NTLM sessions establish a cryptographic session key and negotiate true message signing, thereby reducing the risk of attackers using NTLM relay attacks to impersonate legitimate users.
According to the implementation timeline announced by Microsoft, the first phase begins on November 10, 2026. Windows clients will provide NTLM signing by default in all non-anonymous connections, while servers will temporarily accept both clients that use signing and those that do not. The system will also use audit events to identify clients that have not yet enabled true signing.
The second phase is planned to start in May 2027, at which point Windows Server will require NTLM connections to use message signing by default. Clients that do not provide signing will be rejected by servers under the security configuration.
Microsoft also provides a corresponding audit method. Administrators can check connection status through the Microsoft-Windows-NTLM / Operational log in Windows Event Viewer. Event ID 4022 is used to record client-side information, and event ID 4023 is used to record server-side information.
Microsoft recommends that administrators focus on checking whether the negotiation flags include 0x10 (NTLMSSP_NEGOTIATE_SIGN) and 0x40000000 (NTLMSSP_NEGOTIATE_KEY_EXCH), and confirm that Session Key Status shows Present. If the relevant flags or session key are missing, it means the connection has not yet met the security requirements of the second phase.
This update also introduces two registry configuration items. ClientAllowUnsignedNtlm controls whether the client provides NTLM signing, with a default value of 0, meaning signing is provided by default; ServerRequireNtlmSign controls whether the server enforces signing, also with a default value of 0, meaning it temporarily accepts both signed and unsigned clients. After completing the audit, administrators can set the server-side value to 1 to enable the mandatory signing requirement in advance.
Microsoft specifically noted that this change only affects NTLM authentication and will not affect Kerberos. Anonymous connections and Guest account connections are also explicitly excluded from the mandatory signing requirement. In addition, if a client connects to an older server that does not support true SIGN signing, the client will automatically fall back to the traditional ALWAYS_SIGN mode and will not directly cause the connection to fail.
This security improvement applies to Windows 11 26H2, 26H1, 25H2, 24H2, 23H2, and Windows 10 Enterprise LTSC 2021, and also covers Windows Server 2025, 2022, 2019, and 2016.
- "NTLM signing security improvements in Windows | Microsoft Support"
Advertising statement: External redirect links contained in the article (including but not limited to hyperlinks, QR codes, passwords, and other forms) are used to convey more information and save selection time. The results are for reference only. All articles on IT之家 that contain external links include this statement.
Related Articles
- Microsoft confirms that Win11 23H2 has officially ended support: Enterprise and Education editions stop receiving monthly security updates
- Microsoft releases multiple preview updates for Win11: improves the Windows Hello sign-in experience
- Microsoft releases preview updates such as Win11 26220.9836: search function can now "take action," adjusting volume / brightness no longer requires entering Settings
- Microsoft Win11 26H2 enablement package is only about 174KB, but 23H2 users still need to download about 6.5GB of update patches to upgrade
- Microsoft releases new updates for multiple Win11 preview channels: updates the XBOX game interface, Windows Hello automatically adjusts brightness
- Microsoft secretly tests a new app "Project Odeon," with an interface almost identical to Win11 Settings