{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-164-review-the-delay-imposed-by-smb-authentication-rate-limiting/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-164-review-the-delay-imposed-by-smb-authentication-rate-limiting/", "slug": "dse-20260908-164-review-the-delay-imposed-by-smb-authentication-rate-limiting", "url": "https://update.dsesecurity.com/updates/dse-20260908-164-review-the-delay-imposed-by-smb-authentication-rate-limiting/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-164-review-the-delay-imposed-by-smb-authentication-rate-limiting.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-164-review-the-delay-imposed-by-smb-authentication-rate-limiting/" }, "title": "Review the delay imposed by SMB authentication rate limiting", "summary": "How should administrators validate SMB failed-authentication throttling?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:14:27+00:00", "modified_at": "2026-09-08T18:26:31+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 1, "word_count": 218, "potentially_affected": "Administrators of SMB servers running Windows Server 2025 or Windows 11 version 24H2 and later.", "dse_recommendation": "Choose a nonprivileged test identity and agree on a small, bounded number of failed attempts with the identity owner.", "primary_source": { "name": "Configure SMB authentication rate limiter for Windows", "url": "https://learn.microsoft.com/en-us/windows-server/storage/file-server/configure-smb-authentication-rate-limiter", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft documents an SMB server control that delays failed authentication attempts using NTLM or PKU2U. The control is enabled by default beginning with Windows Server 2025 and Windows 11 version 24H2, with a configurable two-second default delay. Administrators can enable, disable, or configure the limiter through PowerShell or Group Policy. Microsoft Learn.

\n

Applicability

\n

Verify the server version and the authentication method used by the test client. Distinguish this server-side delay from account lockout, SMB signing, or a policy that blocks NTLM. Review the configured value rather than assuming the documented default remains effective.

\n

DSE recommendation

\n

Choose a nonprivileged test identity and agree on a small, bounded number of failed attempts with the identity owner. Record the initial limiter setting and any governing policy. Keep the exercise narrow enough to avoid locking out a real user or creating a noisy authentication incident. Decide in advance what observation would justify changing the delay, and retain a reversible configuration record.

\n

Verification

\n

Compare failed-attempt timing with the effective setting, then confirm that an authorized connection still works. Record client, server, protocol, timestamps, and any account-policy response. If the observed delay differs, investigate scope and authentication behavior before weakening the control. Keep password values out of the evidence.

\n

Official references

\n

Microsoft Learn: Configure SMB authentication rate limiter for Windows. Source reviewed September 8, 2026.

", "content_text": "Source facts\nMicrosoft documents an SMB server control that delays failed authentication attempts using NTLM or PKU2U. The control is enabled by default beginning with Windows Server 2025 and Windows 11 version 24H2, with a configurable two-second default delay. Administrators can enable, disable, or configure the limiter through PowerShell or Group Policy. Microsoft Learn.\nApplicability\nVerify the server version and the authentication method used by the test client. Distinguish this server-side delay from account lockout, SMB signing, or a policy that blocks NTLM. Review the configured value rather than assuming the documented default remains effective.\nDSE recommendation\nChoose a nonprivileged test identity and agree on a small, bounded number of failed attempts with the identity owner. Record the initial limiter setting and any governing policy. Keep the exercise narrow enough to avoid locking out a real user or creating a noisy authentication incident. Decide in advance what observation would justify changing the delay, and retain a reversible configuration record.\nVerification\nCompare failed-attempt timing with the effective setting, then confirm that an authorized connection still works. Record client, server, protocol, timestamps, and any account-policy response. If the observed delay differs, investigate scope and authentication behavior before weakening the control. Keep password values out of the evidence.\nOfficial references\nMicrosoft Learn: Configure SMB authentication rate limiter for Windows. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nMicrosoft documents an SMB server control that delays failed authentication attempts using NTLM or PKU2U. The control is enabled by default beginning with Windows Server 2025 and Windows 11 version 24H2, with a configurable two-second default delay. Administrators can enable, disable, or configure the limiter through PowerShell or Group Policy. [Microsoft Learn](https://learn.microsoft.com/en-us/windows-server/storage/file-server/configure-smb-authentication-rate-limiter).\n\n## Applicability\n\nVerify the server version and the authentication method used by the test client. Distinguish this server-side delay from account lockout, SMB signing, or a policy that blocks NTLM. Review the configured value rather than assuming the documented default remains effective.\n\n## DSE recommendation\n\nChoose a nonprivileged test identity and agree on a small, bounded number of failed attempts with the identity owner. Record the initial limiter setting and any governing policy. Keep the exercise narrow enough to avoid locking out a real user or creating a noisy authentication incident. Decide in advance what observation would justify changing the delay, and retain a reversible configuration record.\n\n## Verification\n\nCompare failed-attempt timing with the effective setting, then confirm that an authorized connection still works. Record client, server, protocol, timestamps, and any account-policy response. If the observed delay differs, investigate scope and authentication behavior before weakening the control. Keep password values out of the evidence.\n\n## Official references\n\n[Microsoft Learn: Configure SMB authentication rate limiter for Windows](https://learn.microsoft.com/en-us/windows-server/storage/file-server/configure-smb-authentication-rate-limiter). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-164-review-the-delay-imposed-by-smb-authentication-rate-limiting/", "url": "https://update.dsesecurity.com/updates/dse-20260908-164-review-the-delay-imposed-by-smb-authentication-rate-limiting/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-164-review-the-delay-imposed-by-smb-authentication-rate-limiting/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Review the delay imposed by SMB authentication rate limiting", "item": "https://update.dsesecurity.com/updates/dse-20260908-164-review-the-delay-imposed-by-smb-authentication-rate-limiting/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-164-review-the-delay-imposed-by-smb-authentication-rate-limiting/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-164-review-the-delay-imposed-by-smb-authentication-rate-limiting/", "url": "https://update.dsesecurity.com/updates/dse-20260908-164-review-the-delay-imposed-by-smb-authentication-rate-limiting/", "headline": "Review the delay imposed by SMB authentication rate limiting", "description": "How should administrators validate SMB failed-authentication throttling?", "abstract": "How should administrators validate SMB failed-authentication throttling?", "articleBody": "Source facts\nMicrosoft documents an SMB server control that delays failed authentication attempts using NTLM or PKU2U. The control is enabled by default beginning with Windows Server 2025 and Windows 11 version 24H2, with a configurable two-second default delay. Administrators can enable, disable, or configure the limiter through PowerShell or Group Policy. Microsoft Learn.\nApplicability\nVerify the server version and the authentication method used by the test client. Distinguish this server-side delay from account lockout, SMB signing, or a policy that blocks NTLM. Review the configured value rather than assuming the documented default remains effective.\nDSE recommendation\nChoose a nonprivileged test identity and agree on a small, bounded number of failed attempts with the identity owner. Record the initial limiter setting and any governing policy. Keep the exercise narrow enough to avoid locking out a real user or creating a noisy authentication incident. Decide in advance what observation would justify changing the delay, and retain a reversible configuration record.\nVerification\nCompare failed-attempt timing with the effective setting, then confirm that an authorized connection still works. Record client, server, protocol, timestamps, and any account-policy response. If the observed delay differs, investigate scope and authentication behavior before weakening the control. Keep password values out of the evidence.\nOfficial references\nMicrosoft Learn: Configure SMB authentication rate limiter for Windows. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:14:27+00:00", "dateModified": "2026-09-08T18:26:31+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-164-review-the-delay-imposed-by-smb-authentication-rate-limiting/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-164-review-the-delay-imposed-by-smb-authentication-rate-limiting/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Review the delay imposed by SMB authentication rate limiting" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 218, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure SMB authentication rate limiter for Windows", "url": "https://learn.microsoft.com/en-us/windows-server/storage/file-server/configure-smb-authentication-rate-limiter" } } ] } }