Event ID 31016: The SMB Signing registry value is not configured with default settings
Windows Event ID Lookup: What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.
Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to
check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition
is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of
Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's
security auditing reference.
The SMB Signing registry value is not configured with default settings.
Event 31016
SMBClient
SMBClient/Connectivity log
Warning
Message and fields (as Event Viewer shows them)
The SMB Signing registry value is not configured with default settings.
Default Registry Value:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters]
"EnableSecuritySignature"=dword:1
Configured Registry Value:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters]
"EnableSecuritySignature"=dword:0
Guidance:
Even though you can disable, enable, or require SMB Signing, the negotiation rules changed starting with SMB2 and not all combinations operate like SMB1.
The effective behavior for SMB2/SMB3 is:
Client Required and Server Required = Signed
Client Not Required and Server Required = Signed
Server Required and Client Not Required = Signed
Server Not Required and Client Not Required = Not Signed
When requiring SMB Encryption, SMB Signing is not used, regardless of settings. SMB Encryption implicitly provides the same integrity guarantees as SMB Signing.