If we change the "smb encrypt" setting from "default" to "required", clients are still able to list share names and connect to services without encryption (although actual file transactions seem to be blocked).  This state remains until smbd is completely restarted -- not even a service reload using SIGHUP works.

Conversely, if we change the "smb encrypt" from "required" to "default", clients continue to be denied unencrypted access to the Samba server until after a full smbd restart.

For example:

jmaggard@justin-rn626:~$ testparm -s 2>/dev/null | grep "smb encrypt"
jmaggard@justin-rn626:~$ smbclient -mNT1 -g -L //localhost/documents
Enter DISCOVERY\jmaggard's password: 
Disk|Documents|
Disk|dr1|
Disk|import|
Disk|Music|
IPC|IPC$|IPC Service ("justin-rn626")
Disk|jmaggard|Home directory of jmaggard
Reconnecting with SMB1 for workgroup listing.
Workgroup|DISCOVERY|JUSTIN-RR4360

jmaggard@justin-rn626:~$ testparm -s 2>/dev/null | grep "smb encrypt"
	smb encrypt = required
jmaggard@justin-rn626:~$ smbclient -mNT1 -g -L //localhost/documents
Enter DISCOVERY\jmaggard's password: 
Disk|Documents|
Disk|dr1|
Disk|import|
Disk|Music|
IPC|IPC$|IPC Service ("justin-rn626")
Disk|jmaggard|Home directory of jmaggard
Reconnecting with SMB1 for workgroup listing.
Workgroup|DISCOVERY|JUSTIN-RR4360

jmaggard@justin-rn626:~$ sudo systemctl restart smb
jmaggard@justin-rn626:~$ smbclient -mNT1 -g -L //localhost/documents
Enter DISCOVERY\jmaggard's password: 
Error returning browse list: NT_STATUS_ACCESS_DENIED
Reconnecting with SMB1 for workgroup listing.