It allows the password to be case-sensitive and uses MD4 to generate the key from the password providing a much more secure encryption method. It can be used at initial logon when a user is logging on to a trusted domain or when connecting to a resource which is in a trusting domain. In both scenarios the user's credentials need to be validated before access is allowed. When a user requests access to a share on the filer, the filer contacts a domain controller which is either in that user's domain or has a trust relationship with the user's domain and verifies that the user is really who they say they are. The Service Pack 3 updates are reflected in updates to the CIFS authentication protocol by adding mutual authentication and also message authentication which is achieved by smb signing.
Mutual authentication adds an additional step where the client authenticates the server.
For additional information on this please refer to the updated CIFS Authentication Protocol paper. SMB signing is the placing of a digital security signature into each SMB which is then verified by both the client and the server. It should be noted that this will incur a performance penalty if used since every smb packet needs to be processed. This performance impact will be felt by any server which is configured to do message authentication whether it be a NetApp filer or a Windows NT server. If SMB signing is enabled on a server, then clients that are also enabled for SMB signing will use the new protocol during all subsequent sessions and clients that are not enabled for SMB signing will use the older SMB protocol.