Review the delay imposed by SMB authentication rate limiting

Source facts

Microsoft documents an SMB server control that delays failed authentication attempts using NTLM or PKU2U. The control is enabled by default beginning with Windows Server 2025 and Windows 11 version 24H2, with a configurable two-second default delay. Administrators can enable, disable, or configure the limiter through PowerShell or Group Policy. Microsoft Learn.

Applicability

Verify the server version and the authentication method used by the test client. Distinguish this server-side delay from account lockout, SMB signing, or a policy that blocks NTLM. Review the configured value rather than assuming the documented default remains effective.

DSE recommendation

Choose a nonprivileged test identity and agree on a small, bounded number of failed attempts with the identity owner. Record the initial limiter setting and any governing policy. Keep the exercise narrow enough to avoid locking out a real user or creating a noisy authentication incident. Decide in advance what observation would justify changing the delay, and retain a reversible configuration record.

Verification

Compare failed-attempt timing with the effective setting, then confirm that an authorized connection still works. Record client, server, protocol, timestamps, and any account-policy response. If the observed delay differs, investigate scope and authentication behavior before weakening the control. Keep password values out of the evidence.

Official references

Microsoft Learn: Configure SMB authentication rate limiter for Windows. Source reviewed September 8, 2026.