Password guessing attacks do not need malware. They just need time.
Brute-force and credential-stuffing attacks against SMB shares remain one of the simplest ways for an attacker to move laterally once inside a network.
Every failed logon attempt against the SMB server is an opportunity for an attacker, and automated tools can generate thousands of attempts in minutes.
Windows 11 includes a built-in defense for exactly this scenario, the SMB authentication rate limiter, which introduces a delay between failed authentication attempts and makes password guessing dramatically slower and more expensive.
The EnableAuthRateLimiter setting controls this behavior, but it is not always enabled or consistently configured across a fleet of devices.
By enforcing this configuration through Microsoft Intune, administrators guarantee that every managed endpoint, regardless of how it was provisioned, applies the same protection against credential-guessing attacks.
The result is an environment where SMB authentication abuse is no longer fast and silent, but throttled, detectable, and far less effective.
Why This Policy Matters
Attackers who gain network access frequently attempt to authenticate against SMB shares using scripted or automated tools that try many password combinations in rapid succession.
Without a throttling mechanism, these attempts can occur almost instantly, making brute-force and credential-stuffing attacks highly efficient.
Without this policy:
- Automated tools can attempt thousands of SMB logon combinations per minute
- Weak or reused passwords become easier to compromise before detection occurs
- Security monitoring has less time to react before an account is breached
- A single compromised foothold can quietly expand into file servers and shared resources
With this setting enforced through Intune:
- Failed SMB authentication attempts are delayed, slowing automated attacks significantly
- Detection and response teams gain a wider window to identify and contain suspicious activity
- Consistent enforcement across all managed endpoints strengthens the overall identity layer
- The control is applied uniformly, with no dependency on how each device was provisioned
This configuration aligns with modern security principles such as defense in depth, endpoint hardening, proactive threat detection, and Zero Trust architecture.
Security Governance
Security governance ensures that hardening controls are consistently applied, monitored, and aligned with organizational standards.
Without centralized governance, settings such as the SMB authentication rate limiter can drift across devices, leaving gaps that attackers can exploit.
Managing the EnableAuthRateLimiter setting through Microsoft Intune brings several governance benefits:
- Centralized, policy-based enforcement instead of manual per-device changes
- Consistent configuration aligned with corporate security baselines
- Clear visibility into deployment status and configuration compliance
- Defined ownership and accountability through scope tags and role-based administration
- An auditable policy lifecycle from pilot to production
This level of governance ensures that SMB hardening is handled in a controlled and transparent manner, reinforcing compliance with internal security policies and regulatory frameworks.
Windows CSP Overview
This section explains how the setting is exposed at the operating system level and how Microsoft Intune interacts with it. The configuration is powered by the Windows Policy Configuration Service Provider (CSP) framework, specifically the LanmanServer area.
| Scope | Editions | Applicable OS |
|---|---|---|
| ✅ Device ❌ User | ✅ Pro ✅ Enterprise ✅ Education ✅ IoT Enterprise / IoT Enterprise LTSC | ✅ Windows 11, version 24H2 [10.0.26100.3613] and later |
This policy controls whether the SMB server will enable or disable the authentication rate limiter; if disabled, the authentication rate limiter won't be enabled, and if not configured, the authentication rate limiter may still be working depending on the delay settings (the recommended delay value is 2000ms).
Description Framework Properties
This section defines how the configuration behaves at a technical level within the CSP framework. Understanding these properties is essential for ensuring correct deployment and avoiding configuration conflicts.
| Property name | Property value |
|---|---|
| Format | int |
| Access Type | Add, Delete, Get, Replace |
| Default Value | 1 |
This means:
- The value is stored as a simple integer
- The default value 1 means the rate limiter is enabled by default on supported builds
- Enforcing it explicitly through Intune removes any dependency on local defaults or manual changes
- It can be centrally managed, monitored, and remediated via Intune
Allowed Values
This section defines the valid configuration values supported by the setting. It accepts the following options:
| Value | Description |
|---|---|
| 0 | Disabled. |
| 1 (Default) | Enabled. |
When set to 1 (Enabled), the SMB server enforces a delay between failed authentication attempts, drastically reducing the speed at which automated tools can guess credentials against managed endpoints.
Group Policy Mapping
For organizations operating in hybrid environments, this CSP setting maps to a corresponding Group Policy configuration.
| Name | Value |
|---|---|
| Name | Pol_EnableAuthRateLimiter |
| Friendly Name | Enable authentication rate limiter |
| Location | Computer Configuration |
| Path | Network > Lanman Server |
| Registry Key Name | Software\Policies\Microsoft\Windows\LanmanServer |
| ADMX File Name | LanmanServer.admx |
This mapping helps administrators understand how the same security control can be represented across traditional Group Policy and modern cloud-based management through Microsoft Intune.
Security Considerations
Before enabling this policy, administrators should understand how it behaves and plan for its impact.
- The setting only affects devices acting as an SMB server, so its impact is most relevant on file servers and endpoints sharing resources over SMB
- Legitimate applications performing rapid, repeated authentication attempts may experience added latency, so validate line-of-business tools before broad rollout
- This setting complements, but does not replace, account lockout policies, conditional access, and Defender for Endpoint attack surface reduction rules
- Supported on Windows 11, version 24H2 (10.0.26100.3613) and later
- Applies at the device scope only, it is not available at the user scope
A phased, pilot-first deployment is recommended to validate the behavior in a controlled group, confirm that line-of-business applications are unaffected, and avoid unexpected impact before rolling the setting out across production devices.
How to Configure Enable Auth Rate Limiter Using Intune (Settings Catalog)
You can enforce this policy centrally using the Intune Settings Catalog, ensuring that the SMB authentication rate limiter is applied consistently across all managed Windows devices.
To begin, sign in to the Microsoft Intune admin center and follow the steps below, as illustrated in the screenshots.
Create the Configuration Profile
In the Microsoft Intune admin center:
- Navigate to Devices › Windows › Configuration
- Select + Create policy
In the Create a profile pane:
- Platform: Windows 10 and later
- Profile type: Settings catalog
Click Create to continue.
At this stage, you have created the foundation of a Settings Catalog policy. In the next steps, you will search for and configure the setting that enables the SMB authentication rate limiter.
Define Basic Profile Details
After clicking Create, the next step is to define the basic details of the configuration profile. This stage is essential for long-term management, clarity, and governance within Microsoft Intune, especially in environments with multiple endpoint hardening policies and security baselines.
Providing a clear Name and a concise but meaningful Description ensures that the purpose of the policy is immediately understood by administrators and security teams in the future. As shown in the screenshot, configure the fields as follows.
The Platform field is already pre-selected as Windows, so no changes are required. Once the name and description are defined, click Next to proceed to the configuration settings.
Configure the Setting Using the Settings Picker
With the profile basics defined, the next step is to configure the policy using the Settings picker, where you select the exact Windows setting you want to enforce. To open the Settings picker panel, click Add settings.
In the search field at the top of the Settings picker, type Enable Authentication Rate Limiter, and then click Search to filter the results.
From the returned results, select the category LanmanServer, and then choose the setting Enable Authentication Rate Limiter. Once selected, the setting is automatically added to the configuration profile. Back on the configuration page, confirm the value is set to Enabled.
When enabled, the SMB server introduces a delay between failed logon attempts. This ensures that:
- Automated password guessing against SMB shares is slowed to a fraction of its original speed
- Brute-force and credential-stuffing attempts become far more expensive for attackers
- Security teams gain valuable time to detect and respond to suspicious authentication activity
This configuration aligns with modern endpoint hardening practices and supports Zero Trust security principles, ensuring that credential-guessing attacks are actively resisted at the protocol level.
Configure Scope Tags (Optional)
Scope tags are used to control who can view and manage this policy within the Microsoft Intune admin center. They are particularly useful in environments with delegated administration, multiple IT teams, or regional management models.
As shown in the screenshot, the Default scope tag is selected. This is the standard and recommended configuration for most environments, as it ensures the policy is visible to all administrators who have access to Intune.
Optionally, custom scope tags can be assigned if you need to:
- Restrict policy visibility to specific IT roles or teams
- Enforce administrative separation of duties
- Support delegated or region-based Intune management
If no additional scope tags are required, keep the Default selection and click Next to continue.
Assignments – Failed Logon Delay
After configuring the policy settings, the next step is to assign the policy to the appropriate target group. Assignments define which devices will receive and enforce this configuration, ensuring the policy is applied in a controlled and intentional manner.
In the Assignments tab, click Add groups under Included groups and search for the group you want to target. This approach allows you to deploy the policy gradually, starting with test devices before expanding to production.
As shown in the screenshot, the policy is assigned to the following group: GRP – MS365Education – Test Computers.
Once the group is selected, verify the following:
- The group appears under Included groups
- The group status is Active
- No assignment filters are applied (unless explicitly required)
At this stage, no Excluded groups are configured, which is appropriate for controlled test deployments.
After confirming the assignment, click Next to proceed to the Review + Create step.
Review + Create – Final Validation
The Review + Create step is the final checkpoint before deploying the policy. This is where you validate that all configurations are correct and aligned with your intended endpoint hardening objective.
Pay special attention to the following items:
- Policy name and description: confirm that the policy clearly reflects its purpose, enforcing the SMB authentication rate limiter so that failed logon attempts are delayed and password guessing attacks are slowed down
- Configuration settings: verify that Enable Authentication Rate Limiter is set to Enabled, under LanmanServer
- Scope tags: ensure the correct scope tag is assigned. In this example, the Default scope tag is used
- Assignments: confirm the policy is assigned to the intended group, GRP – MS365Education – Test Computers, and that no unintended exclusions are configured
Once everything has been validated, click Create to finalize and deploy the policy to the assigned devices.
Monitor Policy Deployment Status
After creating and assigning the WIN – Endpoint Hardening – Failed Logon Delay configuration profile, the next step is to verify its deployment status. This validation confirms that the policy has been successfully applied and that the SMB authentication rate limiter is active on the targeted devices.
Although Microsoft Intune can take up to 8 hours to automatically deliver configuration profiles, deployment often occurs much faster. If needed, you can accelerate the process by:
- Triggering a manual device sync from the Company Portal
- Initiating a sync directly from the Microsoft Intune admin center
Intune provides clear indicators to evaluate the policy deployment status: Succeeded (devices have applied the policy), In progress (devices are still processing), Error (the policy failed and requires investigation), and Not applicable (the device does not support the configuration).
When devices report Succeeded, it confirms that the SMB authentication rate limiter is enforced, ensuring that failed logon attempts against the SMB server are delayed on every targeted endpoint.
Client-Side Verification via Event Viewer
After the device has synced with Intune, you can perform a client-side verification to confirm that the policy was successfully applied. Windows records Intune policy processing events locally, allowing administrators to confirm policy enforcement without relying only on the Intune portal.
- Open Event Viewer on the target device
- Navigate to Applications and Services Logs › Microsoft › Windows › DeviceManagement-Enterprise-Diagnostics-Provider › Admin
- Select Filter Current Log
- Look for Event ID 813 or Event ID 814, which indicate successful processing of Intune configuration policies
- Open the event details and confirm that the LanmanServer setting was applied
For deeper validation, you can confirm the effective configuration directly on the device. Check the registry value under HKLM\SOFTWARE\Policies\Microsoft\Windows\LanmanServer and confirm that EnableAuthRateLimiter is set to 1, or run Get-SmbServerConfiguration in an elevated PowerShell session and verify that EnableAuthRateLimiter reports True.
Once active, failed SMB authentication attempts are delayed by the configured interval, with a default of 2000ms, slowing automated attacks without affecting legitimate successful logons.
Why This Matters for Endpoint Security
Credential-based attacks remain one of the most common entry points in modern endpoint security incidents, because they exploit weak passwords instead of software vulnerabilities.
Without throttling, an attacker with network access can test thousands of credentials against SMB shares in minutes while blending into routine network activity.
By enforcing the SMB authentication rate limiter through Microsoft Intune and validating the configuration locally, organizations ensure that:
- Brute-force attacks against SMB become slow, noisy, and impractical
- The window for detection and response is significantly extended
- Lateral movement through password guessing is actively resisted
- Endpoints remain consistently protected, regardless of how they were provisioned
This configuration provides strong security value without disrupting standard user workflows when properly validated and deployed.
Key Takeaway
Effective endpoint security depends on removing the easy paths attackers rely on.
Enabling the SMB authentication rate limiter is a small configuration change with a meaningful defensive payoff, turning fast, silent password guessing into a slow and detectable operation.
Deployed through Microsoft Intune, it becomes a repeatable, auditable control that reinforces Zero Trust principles and adds another layer to a broader defense in depth strategy across every managed endpoint.
And in modern security architecture, slowing the attacker down is often the difference between an incident and a non-event.
More Information
For additional technical details, refer to the official Microsoft documentation below:
- https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-lanmanserver#enableauthratelimiter
- https://learn.microsoft.com/en-us/mem/intune/configuration/settings-catalog
- https://learn.microsoft.com/en-us/mem/intune/configuration/device-profiles
- https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-monitor
- https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-troubleshoot
Thank you for reading!
🖥️ Ricardo Barbosa
🏆️ Microsoft MVP | 📘 Microsoft Certified Trainer (MCT)
☁️ Intune & Cloud Architect | 💼 Technology Director at Altelix.com
💬 Follow me for more Windows endpoint hardening and Intune content.