SIMS Deployment Issues to Windows 10 1709

[MagicMadjeski]

Hi there,

 

I was wondering if anyone else is experiencing issues deploying SIMS via Solus to Windows 10 1709 update? My SIMS server is currently Server 2008 R2 and when deploying, I get a generic permissions error... I have also noticed that I cannot C$ from the SIMS server to any device with 1709 installed but can to older versions of Windows 10.

 

I have a print server which is also Server 2008 R2 and is up to date with Windows updates but I can C$ to Windows 10 1709 devices from that. If anyone else is experiencing the same issue and knows a work around, I would be very grateful! I'm hoping on hearing that I need to update my SIMS server to newer hardware which supports Server 2016

[smarties11]

File and print sharing is disabled by default in 1709. It needs enabling, you'll then be able to browse the admin shares and assuming you have the firewall configured for SOLUS and WMI exceptions it should work OK. The SOLUS user guide has all the instructions for configuring these.

[fordea]

We are having this issue with new builds of Windows 10 1709 and 1803 and we think it's because Microsoft has disabled SMB1 by default on these builds. Once we turned the SMB1 client and server features on for the workstations we could then browse to their C$ shares from our SIMS server and subsequently deploy SIMS via Solus to them. It's really odd because every other server we've tried was able to access these clients via the admin shares prior to enabling SMB1 support, just not on our SIMS server.

[smarties11]

We are having this issue with new builds of Windows 10 1709 and 1803 and we think it's because Microsoft has disabled SMB1 by default on these builds. Once we turned the SMB1 client and server features on for the workstations we could then browse to their C$ shares from our SIMS server and subsequently deploy SIMS via Solus to them. It's really odd because every other server we've tried was able to access these clients via the admin shares prior to enabling SMB1 support, just not on our SIMS server.

 

It's definitely not an SMBv1 issue. The SOLUS agent works with SMBv2 as confirmed by SIMS on another thread, and myself on our site.

 

I haven't enabled SMBv1 on our 1803 clients and am able to install the agent no problem. You can get it to work with SMBv2 as long as it is set up correctly.

 

The main difference for 1709 onwards is that file and print sharing are disabled by default, as per my previous post. If you enable these either manually on each client or with a group policy, you'll be able to access the admin shares of those clients.

 

No need to enable an insecure protocol!

[fordea]

I'm glad to hear that SOLUS works with SMB2 as I didn't really want to enable SMB1 on our 1803 clients. I tried to enable the file and print sharing as I noticed it's disabled by default on 1803 but no luck. I'll have to troubleshoot this further as it only seems to be our SIMS server that can't access the C$ share of 1803 clients so it's probably a server-side setting.

[fordea]

Right I think we're getting somewhere with this. Found a thread from last year that describes our problem exactly and has a solution: http://www.edugeek.net/forums/windows-10/190793-1709-smb1-issue-only-1-server.html

 

Basically it looks like our server running SIMS has had the SMB2/3 driver startup type set to disabled at some point in the past (no idea why). You can see if this is the case on your server by checking the SMBClient Operational log. We saw the following event each time the server was booted:

 

The SMB 3 and SMB 2 driver is not configured with the default start type.

Default Start Type: DEMAND_START

Configured Start Type: DISABLED

 

The proposed fix is to set the start type back to auto by running the following two commands and then rebooting the server:

sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi

sc.exe config mrxsmb20 start= auto

I'm still waiting for a suitable time to reboot but I'm pretty confident that this will resolve the issue.

 

*EDIT: Just confirming this has worked for us after a reboot, SIMS server can now browse to 1803 admin shares and can deploy the agent to them. We didn't event need to turn on File and Printer sharing in 1803 but we do have the firewall ports configured for this in Group Policy.

Edited May 17, 2018 by fordea

[smarties11]

That's great news! As you say I'm sure this will fix your issue, especially where you were deploying successfully to pre-1709 machines.

[MagicMadjeski]

Right I think we're getting somewhere with this. Found a thread from last year that describes our problem exactly and has a solution: http://www.edugeek.net/forums/windows-10/190793-1709-smb1-issue-only-1-server.html

 

Basically it looks like our server running SIMS has had the SMB2/3 driver startup type set to disabled at some point in the past (no idea why). You can see if this is the case on your server by checking the SMBClient Operational log. We saw the following event each time the server was booted:

 

The SMB 3 and SMB 2 driver is not configured with the default start type.

Default Start Type: DEMAND_START

Configured Start Type: DISABLED

 

The proposed fix is to set the start type back to auto by running the following two commands and then rebooting the server:

sc.exe config lanmanworkstation depend= bowser/mrxsmb10/mrxsmb20/nsi

sc.exe config mrxsmb20 start= auto

I'm still waiting for a suitable time to reboot but I'm pretty confident that this will resolve the issue.

 

*EDIT: Just confirming this has worked for us after a reboot, SIMS server can now browse to 1803 admin shares and can deploy the agent to them. We didn't event need to turn on File and Printer sharing in 1803 but we do have the firewall ports configured for this in Group Policy.

This worked for us! Thank you very much for your help. I may let Capita know as their helpdesk team couldn't help with this.