Active Directory SMB signing not enforced on domain controller

SMB signing helps protect SMB traffic from tampering and relay-style abuse. When SMB signing is not required through Group Policy, a threat actor may exploit this vulnerability to use man-in-the-middle, relay, or reflection techniques against SMB-based systems, especially domain controllers and other critical infrastructure. Recent public research and vulnerability disclosures, including CVE-2025-33073, show that a weak SMB signing posture can increase exposure to modern SMB abuse. Requiring SMB signing through Group Policy is an effective mitigation because it applies the control consistently and reduces the risk of configuration drift on critical systems.