Atliso SMB Health Check

What it does

Windows 11 24H2 flipped two SMB client defaults: signing is now required on all outbound connections, and insecure guest fallback is disabled on Pro. Shares that relied on the old behaviour stop answering with 0x80070035, STATUS_INVALID_SIGNATURE, or a blocked-guest-access error. This script tells you exactly which devices and which servers are affected — before you change anything.

• Checks the client's signing and guest-logon posture against the 24H2 defaults, then walks every live SMB connection and flags unsigned ones by server name and share
• Exits 1 when it finds problems and 0 when the device is clean — the exact shape an Intune remediation detection script wants
• Finds the devices someone already “fixed” with the two-line client relaxation — a marker file makes those devices identifiable months later, when nothing else flags them
• Servers you've accepted the risk on go in $KnownExceptions — still reported, but they stop failing the exit code
• Never disables SMB security blindly — the safe fix is server-side, and the script is built to find the work, not paper over it
• Logs every run to %LOCALAPPDATA%\Atliso\SmbHealthCheck.log with timestamps

Three modes, one script

• Audit (default) — read-only. Reports posture and unsigned connections, exits with a remediation-shaped code. This is what you deploy to the fleet.
• Bridge — the temporary client relaxation, done so you can find it later. Records the previous config before changing anything and writes a marker with a review date. Use it narrowly, on a scoped device group, only where a server genuinely can't sign.
• Restore — puts the client back to 24H2 defaults and removes the marker. Run it once the server behind the exception is fixed.

Configuration

The config surface is one block at the top — same as the drive mapper. Nothing else needs editing:

Deploy in Intune

Run it as a Remediation, not a platform script — the whole point is fleet-wide visibility:

1. In the Intune admin center: Devices > Scripts and remediations > Remediations > Create.
2. Detection script: Atliso-SmbHealthCheck.ps1 as-is. Audit is the default mode, and its exit codes are already remediation-shaped.
3. Remediation script: optional. For automatic bridging on a scoped group of known-bad devices, use a copy with $Mode = "Bridge". For most fleets, leave remediation empty and use the detection results as your worklist.
4. Set Run script in 64-bit PowerShell: Yes. System context is fine — this script reads machine-level config, unlike the drive mapper.
5. Assign to a device group and start with a pilot ring.

Within a day you have a report of exactly which devices can't reach which servers and why, without changing anything. Fix the servers on that list, watch the detections go green.

Full background — what changed in 24H2, why the two-line client fix is the wrong one for a managed fleet, and the right order of operations: Windows 11 24H2 Broke Your Mapped Drives. Here's the Fix That Doesn't Kill Security.

Already subscribed? Every tool lives in the vault.