diff --git a/fs/smb/server/server.c b/fs/smb/server/server.c
index f5baba934840..960c4c897c11 100644
--- a/fs/smb/server/server.c
+++ b/fs/smb/server/server.c
@@ -112,6 +112,7 @@ static int __process_request(struct ksmbd_work *work, struct ksmbd_conn *conn,
 {
 	struct smb_version_cmds *cmds;
 	u16 command;
+	bool signed_req;
 	int ret;
 
 	if (check_conn_state(work))
@@ -138,7 +139,14 @@ static int __process_request(struct ksmbd_work *work, struct ksmbd_conn *conn,
 		return SERVER_HANDLER_ABORT;
 	}
 
-	if (work->sess && conn->ops->is_sign_req(work, command)) {
+	signed_req = conn->ops->is_sign_req && conn->ops->is_sign_req(work, command);
+	if (work->sess && work->sess->sign && !work->encrypted &&
+	    !signed_req) {
+		conn->ops->set_rsp_status(work, STATUS_ACCESS_DENIED);
+		return SERVER_HANDLER_ABORT;
+	}
+
+	if (work->sess && signed_req) {
 		ret = conn->ops->check_sign_req(work);
 		if (!ret) {
 			conn->ops->set_rsp_status(work, STATUS_ACCESS_DENIED);
diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c
index bec692bca1ca..d54b714cc36c 100644
--- a/fs/smb/server/smb2pdu.c
+++ b/fs/smb/server/smb2pdu.c
@@ -9596,8 +9596,7 @@ bool smb2_is_sign_req(struct ksmbd_work *work, unsigned int command)
 	struct smb2_hdr *rcv_hdr2 = smb_get_msg(work->request_buf);
 
 	if ((rcv_hdr2->Flags & SMB2_FLAGS_SIGNED) &&
-	    command != SMB2_NEGOTIATE_HE &&
-	    command != SMB2_OPLOCK_BREAK_HE)
+	    command != SMB2_NEGOTIATE_HE)
 		return true;
 
 	return false;