CIS Microsoft Windows 10 Enterprise RTM (Release 1507) Benchmark

2.3.9.5 (L1) Set 'Microsoft network server: Server SPN target name
validation level' to 'Accept if provided by client' or higher (Scored)
Profile Applicability:
Level 1
Level 1 + BitLocker
Description:
This policy setting controls the level of validation a computer with shared folders or
printers (the server) performs on the service principal name (SPN) that is provided by the
client computer when it establishes a session using the server message block (SMB)
protocol.
The server message block (SMB) protocol provides the basis for file and print sharing and
other networking operations, such as remote Windows administration. The SMB protocol
supports validating the SMB server service principal name (SPN) within the authentication
blob provided by a SMB client to prevent a class of attacks against SMB servers referred to
as SMB relay attacks. This setting will affect both SMB1 and SMB2.
This security setting determines the level of validation a SMB server performs on the
service principal name (SPN) provided by the SMB client when trying to establish a session
to an SMB server.
The recommended state for this setting is: Accept if provided by client. Configuring
this setting to Required from client also conforms with the benchmark.
Rationale:
The identity of a computer can be spoofed to gain unauthorized access to network
resources.
Audit:
Navigate to the UI Path articulated in the Remediation section and confirm it is set as
prescribed. This group policy setting is backed by the following registry location:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters:SMBServer
NameHardeningLevel
185 | P a g e