Require SMB Signing to Prevent NTLM Relay and Man-in-the-Middle Attacks

An attacker on the network can run Responder to capture NTLM authentication and ntlmrelayx to simultaneously relay those credentials to other servers. If the relayed account has local admin rights on the target, the attacker gains immediate code execution. This is one of the most effective lateral movement techniques in Windows environments and is extensively used by both penetration testers and real attackers.

SMB signing cryptographically signs SMB communications to prevent tampering and replay attacks. Without it, an attacker using tools like Responder, ntlmrelayx, or Impacket can intercept NTLM authentication attempts and relay them to authenticate to other servers in real time. This technique bypasses password knowledge entirely — the attacker never needs to know the password.

Probably yes if any of these apply:

SMB relay is listed as a finding in the vast majority of internal penetration test reports for Windows environments. A penetration tester on a standard workstation can compromise a Domain Controller within an hour using only Responder and ntlmrelayx in an environment where SMB signing is not required.