Check if your computers are ready for required SMB signing before enforcing it domain-wide.
This tool checks every computer in your domain to see if they have SMB signing turned on. It creates a report showing which computers are ready and which ones need to be fixed.
The audit script only reads information. It does NOT make any changes to your computers.
Download: smb_audit.zip
The ZIP file contains 5 PowerShell scripts:
Run this FIRST on your Domain Controller. It sets everything up and copies files to the right place.
This checks one computer's SMB settings and saves the results. Deploy this to all computers via N-Central.
Optional launcher for N-Central. Runs SMB_Audit.ps1 from the network location automatically.
Reads all the audit results and creates an easy-to-read HTML report showing compliance status.
Run this AFTER auditing is complete to remove "Everyone" permissions from the log share for security.
cd C:\Temp\smb_audit.\Deploy-smb_auditSystem.ps1The script will create the network folder and copy everything to NETLOGON.
If PowerShell blocks the script, you can bypass the execution policy temporarily:
PowerShell.exe -ExecutionPolicy Bypass -File .\Deploy-smb_auditSystem.ps1Learn more: PowerShell Execution Policy Bypass Methods
Use N-Central to run SMB_Audit.ps1 on all computers, or run it manually:
.\SMB_Audit.ps1Each computer saves its results to the network share automatically.
After computers have run the audit, create the report:
.\Analyze-smb_audit.ps1Press Enter to use the default location. The report opens in your web browser.
Do NOT turn on required SMB signing at the domain level until the report shows 100% compliance. If you do it too early, computers will lose access to file shares!
After all audits are collected and you're done using the tool, run the cleanup script to secure the log share:
.\Cleanup-smb_auditShare.ps1This removes "Everyone" permissions so only administrators can access the logs.
NOTE: If you need to run audits again later, just re-run .\Deploy-smb_auditSystem.ps1 to reset permissions.
Purpose: Initial setup - run this first
What it does:
When to run: Once at the beginning, or again if you need to reset permissions
Purpose: Collect SMB settings from one computer
What it does:
When to run: On every computer you want to audit (via N-Central or manually)
Purpose: Optional N-Central launcher
What it does:
When to run: Use this in N-Central instead of SMB_Audit.ps1 if you prefer
Purpose: Create the compliance report
What it does:
When to run: Whenever you want to check progress
Purpose: Secure the log share when done
What it does:
When to run: After you're done collecting audits and don't need computers writing to the share anymore
Here's the full workflow from start to finish:
The HTML report uses colors to show status:
A computer is fully compliant when BOTH of these are set to "Required":
Check if they're there:
dir \\YourDomain\NETLOGON\smb_auditIf empty, run deploy again:
.\Deploy-smb_auditSystem.ps1Test if you can reach it:
Test-Path \\YourServer\smb_auditCheck permissions:
Get-SmbShareAccess -Name "smb_audit"Possible reasons:
Check the folder:
dir \\YourServer\smb_audit\*.csv