-
Title
Unable to access Samba share from Windows 10 client. -
Description
The error appears when attempting to access Samba share from a Windows 10 machine builds 1709 or higher (e.g. 1803, 1809). Samba share access is accessible from a Windows 7 machine without any issue.
The following error can also appear: "You can't access this shared folder because your organization's security policies block unauthenticated guest access. These policies protect your PC from unsafe or malicious devices on the network."
-
Cause
Per Microsoft's article from Guest access in SMB2 disabled by default in Windows 10, Windows Server 2016 version 1709, and Windows Server 2019:
"This change in default behavior is by design and is recommended by Microsoft for security.A malicious computer that impersonates a legitimate file server could allow users to connect as guests without their knowledge. Microsoft recommends that you do not change this default setting. If a remote device is configured to use guest credentials, an administrator should disable guest access to that remote device and configure correct authentication and authorization.Windows and Windows Server have not enabled guest access or allowed remote users to connect as guest or anonymous users since Windows 2000. Only third-party remote devices might require guest access by default. Microsoft-provided operating systems do not."
-
Resolution
1. Click on the Windows key
2. Type gpedit.msc to bring up and then select the "Edit group policy".
3. Under Computer Configuration, expand Administrative Templates-> Network. Highlight Lanman Workstation.
4. By default, the options under Lanman Workstation setting are configured in a "Not configured" state. Double-click to or right click on "Enable insecure guest logons" then left click on Edit to edit.
5. Click the Enabled elliptic button then click on OK or Apply button at the bottom of the page.
6. A reboot of this client might be necessary. Perform another test to access the Samba share using the Samba share IP address (instead of the hostname or FQDN).
Note: This assumes there are no antivirus or firewall configuration issues. Disable any of those software as an additional troubleshooting step if necessary. Make sure the target client and the Samba share are on the same subnet to avoid firewall/router/proxy configuration issues.
Warning: Quest/KACE support is not responsible for the configuration change described in this article. Please consult with Microsoft about the risk associated with the configuration changes.