SMB Signing Performance Impact

Jiya Raha 100 Reputation points
2026-06-23T03:19:35.2933333+00:00

Hello everyone,

Our security team is reviewing options to strengthen protections against lateral movement and NTLM relay attacks within our internal network. One of the recommendations is to enforce SMB Signing on all Windows client devices through Group Policy.

Before rolling this out across the organization, I'd like to better understand the operational impact. Most of our users regularly access shared folders hosted on local file servers and NAS devices, including large documents, media files, and departmental archives.

If we enable "Microsoft network client: Digitally sign communications (always)" and require SMB Signing on all Windows workstations:

  • How much performance overhead should we expect during file transfers?
  • Is the impact generally noticeable on modern hardware and Gigabit/10-Gigabit networks?
  • Are there specific workloads (large file copies, many small files, roaming profiles, etc.) that tend to be affected more than others?
  • Has anyone deployed SMB Signing organization-wide, and if so, were there any unexpected compatibility or performance issues?

Any recommendations, real-world experiences, or best practices would be greatly appreciated.

Thank you.

Windows for business | Windows 365 Business
0 comments
Answer accepted by question author
Harry Phan 32,835 Reputation points Independent Advisor
2026-06-23T03:57:41.26+00:00

Hello Jiya,

Turning on SMB signing means your computer checks every file transfer for authenticity, which adds a little extra work for the CPU. On modern machines and fast networks, this slowdown is barely noticeable when opening documents or browsing shared folders. The only time you might feel it is with very large file copies or when dealing with thousands of tiny files, since each one needs to be verified.

Older storage devices that don’t support signing could stop working once it’s enforced, so it’s important to confirm compatibility first. Most companies that have enabled it across their network report no major issues, and the added protection against attacks is worth the small trade‑off. If you want peace of mind, you can run a performance test and check device compatibility before rolling it out everywhere.

Harry.

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.