SMB3 signing required — MFP compatibility steps

Joe B.

Expert ★★★★★ 27,853 satisfied customers

Specialities: Windows 11/10, Printers & MFPs, SMB/CIFS, Group Policy, Windows Server 2019/2022

Fix “SMB3 signing required” for scan-to-folder — SMB2/SMB3 policies, GPO, NAS & legacy MFP settings

Technician

Hi! We’ll get your scan-to-folder working again. When an MFP says “SMB3 signing required” or “SMB2/3 signing required”, Windows/Server or NAS is enforcing SMB signing, but the device can’t sign packets. A few checks: Which OS hosts the share (Windows 11/10, Server 2019/2022, or a NAS like Synology/QNAP)? Do you log in with a local user (non-admin) and NTLMv2? What SMB version does the printer’s firmware claim to support (SMB1, SMB2, SMB3)?

Customer

The shared folder is on Windows 11 Pro. The copier is older — supports SMB2 but I don’t see an option for signing. After updates we started getting “SMB3 signing required” and scans fail.

Technician

Got it. Recent Windows hardening can set SMB signing = required on the server side (LanmanServer). If your MFP supports SMB2 but not signing, the server rejects the session. Our plan:
1) Confirm the printer’s SMB level and update firmware (many vendors add SMB3/signing in updates).
2) If the device can sign — enable signing on the MFP/NAS.
3) If it cannot — make signing optional on the Windows machine hosting the share (via Local Security Policy/Group Policy) or use alternative transport (FTP/SMB proxy). We’ll do it safely, with NTLMv2 only and a dedicated least-privilege account.

Customer

I can update firmware later. For now I just need scanning back. How do I change the signing policy in Windows 11?

Technician

Step 1 — Make SMB signing optional on the share host (temporary compatibility)
• Open Local Security Policy → Local Policies → Security Options.
• Set “Microsoft network server: Digitally sign communications (always)” = Disabled.
• Keep “… (if client agrees)” = Enabled so modern clients will still sign.
• In Group Policy this is under Computer Configuration → Windows Settings → Security Settings → Local Policies.
• Restart the Server service or reboot. This changes RequireSecuritySignature for LanmanServer.

Customer

Done. The error changed — now I get “login failure”. What about the account and NTLM settings?

Technician

Step 2 — Create a dedicated “scan” account with NTFS/share permissions
• Make a local user, e.g. scan_smb. Give it a strong password; deny interactive logon.
• Folder → Properties → Sharing → Advanced Sharing: grant Change permission. NTFS: Modify to the target directory only.
• Ensure the machine uses NTLMv2: in Security Policy set “Network security: LAN Manager auth level” to Send NTLMv2 response only.
• On the MFP, enter Server = host’s IP, Share = folder name, Path = subfolder if any, Port = 445. User = .\scan_smb (or HOSTNAME\scan_smb).

Customer

Now it connects but sometimes says “SMB protocol not supported”. The copier’s menu shows SMB1/SMB2 only.

Technician

Step 3 — Keep SMB2 enabled; avoid SMB1 unless isolated
• In Windows Features, SMB 1.0/CIFS should remain off. If the device truly requires SMB1, enable it only as a short-term workaround and isolate the printer VLAN.
• Verify SMB2/SMB3 is active: PowerShell Get-SmbServerConfiguration → EnableSMB2Protocol = True.
• If the MFP supports SMB2 but not signing, our Step 1 allows it to connect while we plan a firmware update or replacement.

Customer

We also scan to a Synology NAS. Does it have similar signing settings?

Technician

Yes. On NAS (Synology/QNAP/TrueNAS) set SMB minimum = SMB2, maximum = SMB3, and toggle Enable SMB signing to match your device (optional if the MFP can’t sign). Create a dedicated scan user and folder ACLs. Some NAS support SMB encryption—leave it off for legacy MFPs that can’t handle it.

Customer

We’re a small domain with a couple of laptops on VPN. Anything to consider with Group Policy?

Technician

For AD-joined PCs use a GPO linked to the OU that hosts the file server/Windows share.
• Microsoft network server: Digitally sign communications (always) = Disabled (or Not Configured) while you validate the MFP.
• Keep Client signing “if client agrees” = Enabled so Windows endpoints still sign.
• Enforce NTLMv2, disable guest access, and restrict the scan_smb account to that single share.
• After a firmware update that adds signing, flip the policy back to Required.

Customer

Scanning now works. What else should I check so it stays reliable and secure?

Technician

Final checks for long-term stability:
• Update the MFP’s firmware; enable SMB3 signing if available and then set the server policy back to Required.
• Assign a static IP to the MFP and use DNS; avoid DHCP changes breaking the path.
• Use a dedicated scan user with minimum permissions; rotate the password and update it on the device.
• Document settings (server path, share, auth method, SMB min/max) for quick recovery after Windows updates.

Customer

Perfect — “SMB3 signing required” is gone and scan-to-folder works again. Thanks!

Technician

Summary: To fix “SMB3 signing required” on MFPs: make server-side SMB signing optional temporarily, use a dedicated NTLMv2 account, keep SMB2/SMB3 enabled, and align NAS/MFP settings. Then update firmware and re-enable required signing for security. Need help applying GPO or NAS policies? Open the chat.

Quick answer: the accepted fix

Accepted fix when an MFP shows “SMB3 signing required”: on the Windows/NAS host make SMB signing optional, use a dedicated user with NTLMv2, keep SMB2/SMB3 enabled, and configure the device to the share over port 445. After firmware adds signing support, switch the server policy back to Required.

FAQ

Step-by-step (Windows 11/10 & Server)

1. On the share host, set Server signing (always) = Disabled; keep if client agrees = Enabled. Restart the Server service.
2. Create a dedicated local user (scan_smb), grant Share Change and NTFS Modify to the folder.
3. Confirm SMB2/SMB3 enabled (Get-SmbServerConfiguration), avoid SMB1 unless isolated.
4. Program the MFP: host IP/DNS, share name, path, port 445, NTLMv2 credentials. Test and then update firmware; re-enable required signing for security.

Note for mixed environments (macOS/NAS)

1. On NAS set SMB minimum = SMB2, maximum = SMB3; signing optional if the MFP can’t sign.
2. macOS clients will still sign; this change only affects the server the MFP uses.

Sources

• Microsoft — SMB security & signing overview
• Microsoft — Configure SMB signing via policy
• Synology — SMB service settings (min/max, signing)

Matt ● replies in < 1 min

Technician Expert

⭐⭐⭐⭐⭐ Trusted by 27,000+ customers

Alex · Expert's Assistant

Start Chat

5 Tech Support Specialists are online right now.