nmap --script=smb2-security-mode.nse -p445 $IP

[[SMB Signing Check.png]]

Note:

  1. Message signing enabled and required = cannot relay

  2. Message signing disabled or enabled but not required = can relay

By default, normal workstations #2 while servers (DCs included) #1