Enable authentication rate limiter
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows\LanmanServer\EnableAuthRateLimiter
A DWORD value of 1 enables the Windows SMB server authentication rate limiter. The limiter introduces a delay after failed NTLM- and PKU2U-based authentication attempts, reducing the number of passwords that can be tried through SMB within a given period.
EnableAuthRateLimiter does not itself define the length of the delay. The delay is controlled by a separate SMB server setting, for which Microsoft documents a default of 2000 milliseconds.
Notes
Security
The delay makes brute-force attacks against accounts reachable through SMB substantially more time-consuming. It does not completely prevent authentication attempts, lock accounts, or block SMB connections. Microsoft therefore describes the feature as a defense-in-depth measure.
The rate limiter covers failed NTLM- and PKU2U-based authentication attempts. It does not affect normal Kerberos authentication because Kerberos authentication occurs before an application protocol such as SMB establishes its connection. This registry value also provides no protection for authentication through other network services.
Possible side effects
Legitimate failed NTLM- or PKU2U-based authentication attempts against the SMB server are subject to the same delay. Repeated attempts using incorrect or outdated credentials can therefore receive slower responses.
Notes
This is a computer-scoped policy value of type REG_DWORD; 1 means enabled and 0 means disabled.
Microsoft documents the SMB authentication rate limiter for Windows Server 2025 and Windows 11, version 24H2 or later. The feature is enabled by default on these operating systems. Its protection is relevant only when the SMB server is reachable over the network.
Microsoft documentation
Microsoft Learn: LanmanServer Policy CSP – EnableAuthRateLimiter
Microsoft Learn: Configure SMB authentication rate limiter for Windows