How to Enable or Disable the SMB Client Encryption Requirement in Windows 11 SMB, or Server Message Block, is everywhere. It’s how Windows handles file sharing, printer access, and all sorts of resource connections. The problem? If SMB traffic isn’t encrypted, it can be exposed or intercepted, especially on public or untrusted networks. In this guide, we’ll outline four ways to enable or disable the SMB client “encryption required” setting in Windows 11. Before we begin, be sure to subscribe to NinjaOne's IT Video Hub and our YouTube channel for more tech content like this. 4 Methods for Configuring the SMB Client Encryption Requirement Let’s start with the method most IT pros prefer: PowerShell. It’s fast, scriptable, and perfect for remote administration. Open PowerShell and use the following scripts: To enable required encryption... To disable it, use this... Finally, use this script to verify your current configuration... For this last script, look for the RequireEncryption field. It’ll show True or False depending on your setup. Next, let’s cover Group Policy, which is perfect for enterprise-scale deployments. Press Win + R, type gpedit.msc, and hit Enter. Go to: Computer Configuration > Administrative Templates > Network > Lanman Workstation As an optional step, double-click Enable insecure guest logons and set it to Disabled for better security. Find Encrypt all SMB client connections and set it to Enabled. Click OK, then either restart your computer or run gpupdate /force. This applies the encryption policy to all domain-joined machines governed by that GPO. You can even scope it to specific OUs or devices if you need phased rollouts. If you’re working in an offline or isolated environment, you can edit the Registry directly. Press Win + R, type regedit, and hit Enter. Navigate to. .. Set it to 1 to require encryption, or 0 to disable this requirement. Restart your PC or File Explorer to apply the change. Finally, let’s look at a simple .reg file method. This is great for quick deployment or adding to provisioning scripts. To enable encryption, use this... Here's the script for disabling encryption... Save either file as .reg, double-click to merge, and then restart your system or sign out/in to apply. Additional Considerations Before rolling this out, here are a few things to keep in mind: SMB encryption requires version 3.0 or newer. Older devices or NAS boxes that don’t support it will reject connections. Encryption adds CPU overhead. Test first in high-throughput environments like CAD workstations or VDI profiles. Encryption includes signing, so you don’t need both. The bottom line is that SMB encryption should be the standard in every managed environment. It protects sensitive data in transit, helps meet compliance standards, and prevents one of the most common attack vectors in Windows networks. For more information, check out our official blog post on how to enable or disable the SMB client encryption requirement in Windows 11, linked in the description below.