Cannot Join Domain Because of SMB Signing

RESOLUTION

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

There are two different ways of resolving this problem:

Option 1:

Temporarily disable SMB Signing on the PDC.

NOTE: This option is required to get a backup domain controller (BDC) successfully added to the domain.

1. Run Registry Editor (Regedt32.exe).
2. From the HKEY_LOCAL_MACHINE subtree, go to the following key:
   System\CurrentControlSet\Services\LanManServer\Parameters
3. Set the following value to 0:

   Name: RequireSecuritySignature
   Type: REG_DWORD
   Value: 0 (disable), 1 (enable)

   
   NOTE: The default is 0 (disable)
4. Click OK and then quit Registry Editor.
5. Shut down and restart Windows NT.

Option 2:

Temporarily join a workgroup, and then enable SMB Signing on the member server or workstation prior to joining the domain.

NOTE: Windows NT Workstation Service Pack 3 or later has SMB Signing enabled by default. Windows NT Server has SMB Signing disabled by default.

To re-enable SMB Signing on a computer running Windows NT Workstation 4.0 Service Pack 3 or later:

1. Run Registry Editor (Regedt32.exe).
2. From the HKEY_LOCAL_MACHINE subtree, go to the following key:
   \System\CurrentControlSet\Services\Rdr\Parameters
3. Click Add Value on the Edit menu.
4. Modify the following value:

   Value Name: EnableSecuritySignature
   Data Type: REG_DWORD
   Data: 1

   
   NOTE: The default is 1 (enable)
5. Click OK and then quit Registry Editor.
6. Shut down and restart Windows NT.

To enable SMB Signing on a computer running Windows NT Server Service Pack 3 or later:

1. Run Registry Editor (Regedt32.exe).
2. From the HKEY_LOCAL_MACHINE subtree, go to the following key:
   System\CurrentControlSet\Services\LanManServer\Parameters
3. Set the following value to 1:

   Name: EnableSecuritySignature
   Type: REG_DWORD
   Value: 1

   
   NOTE: The default is 0 (disable)
4. Click OK and then quit Registry Editor.
5. Shut down and restart Windows NT.