Unable to Access SBM Share Windows 11

[talksr]

Hi there,

 

As we move between servers, I have put one of the staff shared areas in an SMB share on our NAS. The share has no password, so anyone with the share IP and folder name, can access it.

 

It seems to be working nicely but not on our Windows 11 stations.

If I try and browse to the share as an administrator, I see the following message which suggests my sec policy is blocking this.

 

 

 

 

 

 

I am able to ping the NAS from the Windows 11 clients, just can't actually access it.

If a user logs in, the netlogon batch shows the following error:

 

I am assuming the Windows 11 system is trying to authenticate with the share using the logged in Windows account even though the share has no username or password.

The NAS in question is just a standalone Netgear ReadyNAS 104.

 

Can anyone suggest the best work around? This will only be needed until the end of the summer hols.

 

Thanks in advance.

[dmj]

IIRC MS recently changed the SMB client on windows 11 so that they have to authenticate against signed SMB servers.

Presumably this is so that it makes things more difficult and organisations throw out their old NAS servers and everyone migrates to (microsofts) cloud - I can't think of an actual security reason why it's necessary on an internal network (they could just remember the trusted share is signed and always connect to that)

 

You probably need to tell the clients to trust an unsigned SMB share.

[Michael]

On the NAS, navigate to System > Settings > SMB, is SMB3 enabled globally?

 

This is from Netgear ReadyNAS 214, so I'm guessing the 104 might be similar.

[dmj]

^^^ if the SMB server supports signing then this is the way forward

[talksr]

On the NAS, navigate to System > Settings > SMB, is SMB3 enabled globally?

 

This is from Netgear ReadyNAS 214, so I'm guessing the 104 might be similar.

 

Thank you. I have taken a look, but it doesn't seem there are any settings for this. All I can do is enable SMB and give a workgroup name...

 

I am assuming it is because it is an older model maybe?

[dmj]

https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-signing?tabs=group-policy

[Michael]

Thank you. I have taken a look, but it doesn't seem there are any settings for this. All I can do is enable SMB and give a workgroup name...

[ATTACH=CONFIG]71694[/ATTACH]

 

I am assuming it is because it is an older model maybe?

 

Possibly - just make sure it's on the latest firmware.

[talksr]

Possibly - just make sure it's on the latest firmware.

 

Hi,

There was a firmware update available but I was very reluctant to put it on as last time I did so, the whole thing stopped working, though it was on the previous model.

I have put the new firmware on and I now get the following:

 

I have selected Configure Globally under SMB3 Transport Encryption and made sure it is enabled. Fingers crossed this will do the job!

Edited June 20, 2024 by talksr

[Michael]

That should do it. I untick Legacy Windows Discovery and enable SMB3 globally.

[DavonPotter]

It sounds like you're dealing with some Windows 11 compatibility issues accessing an SMB share on your NAS. Have you tried adjusting the network and sharing settings in Windows 11 to allow connections to devices without passwords? Sometimes tweaking those settings or adjusting network policies can resolve access issues like this. If it's just a temporary setup, ensuring everything is set up correctly for the duration might be your best bet. Good luck getting it sorted before the end of summer break!

[talksr]

It sounds like you're dealing with some Windows 11 compatibility issues accessing an SMB share on your NAS. Have you tried adjusting the network and sharing settings in Windows 11 to allow connections to devices without passwords? Sometimes tweaking those settings or adjusting network policies can resolve access issues like this. If it's just a temporary setup, ensuring everything is set up correctly for the duration might be your best bet. Good luck getting it sorted before the end of summer break!

 

Thanks for your post. This is exactly what I was looking to do but I have not had a chance to and plan to this Thursday.

 

I had found the following online, and was going to give that a go on Group Policy:

Workaround

If you cannot disable the use of guest for your third party, you must disable the requirement of SMB signing. Obviously, this means that now not only are you using guest access, but you're also preventing your client from guaranteeing signing to a trusted device. That's why this is just a workaround, and we don't recommend it.

 

 

 

You can disable the SMB signing requirement three ways:

 

 

 

Graphical (local group policy on one device)

Open the Local Group Policy Editor (gpedit.msc) on your Windows device.

In the console tree, select Computer Configuration > Windows Settings > Security Settings> Local Policies > Security Options.

Double-click Microsoft network client: Digitally sign communications (always).

Select Disabled > OK.

 

 

Command-line (PowerShell on one device)

Open an administrator-elevated PowerShell console.

Run

Set-SmbClientConfiguration -RequireSecuritySignature $false

 

 

Domain-based group policy (on IT-managed fleets)

Locate the security policy applying this setting to your Windows devices (you can use GPRESULT /H on a client to generate a resultant set of policy report to show which group policy is requiring SMB signing.

In GPMC.MSC, change the

Computer Configuration > Policies > Windows Settings > Security Settings> Local Policies > Security Options.

Set Microsoft network client: Digitally sign communications (always) to Disabled.

Apply the updated policy to Windows devices needing guest access over SMB.