Windows 2008 R2 SMB / CIFS Logging to diagnose Brother MFC Network Scanning

Question

I am attempting to setup network scanning on a brother MFC-9970CDW printer. According to the Brother documentation, the printer is setup to connect to any CIFS network share. I applied all of the appropriate setting in the printer however I get a "sending error" when I try to scan a document.

When I look at the logs of the 2008 R2 server that I am attempting to connect to; I can see in the security log where the printer successfully authenticates, however nothing else is logged.

I would assume that immediately after the authentication, the printer is making a CIFS request and some sort of error is occurring, however I can't seem to find any way to log this information to find out what is going on. Is it possible to get Windows 2008 to log SMB/CIFS traffic?

Followup:

I installed Microsoft netmon and captured the packets associated with the transaction:

510 3:04:28 PM 7/9/2012 34.4277743  System  192.168.1.134   192.168.1.10    SMB SMB:C; Negotiate, Dialect = NT LM 0.12  {SMBOverTCP:30, TCP:29, IPv4:22}
511 3:04:28 PM 7/9/2012 34.4281246  System  192.168.1.10    192.168.1.134   SMB SMB:R; Negotiate, Dialect is NT LM 0.12 (#0), SpnegoToken (1.3.6.1.5.5.2)   {SMBOverTCP:30, TCP:29, IPv4:22}
519 3:04:29 PM 7/9/2012 34.8986214  System  192.168.1.134   192.168.1.10    SMB SMB:C; Session Setup Andx, NTLM NEGOTIATE MESSAGE   {SMBOverTCP:30, TCP:29, IPv4:22}
520 3:04:29 PM 7/9/2012 34.8989310  System  192.168.1.10    192.168.1.134   SMB SMB:R; Session Setup Andx, NTLM CHALLENGE MESSAGE - NT Status: System - Error, Code = (22) STATUS_MORE_PROCESSING_REQUIRED  {SMBOverTCP:30, TCP:29, IPv4:22}
522 3:04:29 PM 7/9/2012 34.9022870  System  192.168.1.134   192.168.1.10    SMB SMB:C; Session Setup Andx, NTLM AUTHENTICATE MESSAGEVersion:v2, Domain: CORP, User: PRINTSUPOFF, Workstation: BRN001BA9AD1FE6   {SMBOverTCP:30, TCP:29, IPv4:22}
523 3:04:29 PM 7/9/2012 34.9032421  System  192.168.1.10    192.168.1.134   SMB SMB:R; Session Setup Andx   {SMBOverTCP:30, TCP:29, IPv4:22}
525 3:04:29 PM 7/9/2012 34.9051855  System  192.168.1.134   192.168.1.10    SMB SMB:C; Tree Connect Andx, Path = \\192.168.1.10\IPC$, Service = ?????   {SMBOverTCP:30, TCP:29, IPv4:22}
526 3:04:29 PM 7/9/2012 34.9053083  System  192.168.1.10    192.168.1.134   SMB SMB:R; Tree Connect Andx, Service = IPC {SMBOverTCP:30, TCP:29, IPv4:22}
528 3:04:29 PM 7/9/2012 34.9073573  System  192.168.1.134   192.168.1.10    DFSC    DFSC:Get DFS Referral Request, FileName: \\192.168.1.10\NSCFILES, MaxReferralLevel: 3   {SMB:33, SMBOverTCP:30, TCP:29, IPv4:22}
529 3:04:29 PM 7/9/2012 34.9152042  System  192.168.1.10    192.168.1.134   SMB SMB:R; Transact2, Get Dfs Referral - NT Status: System - Error, Code = (549) STATUS_NOT_FOUND   {SMB:33, SMBOverTCP:30, TCP:29, IPv4:22}
531 3:04:29 PM 7/9/2012 34.9169738  System  192.168.1.134   192.168.1.10    SMB SMB:C; Tree Disconnect  {SMBOverTCP:30, TCP:29, IPv4:22}
532 3:04:29 PM 7/9/2012 34.9170688  System  192.168.1.10    192.168.1.134   SMB SMB:R; Tree Disconnect  {SMBOverTCP:30, TCP:29, IPv4:22}

As you can see, the DFS referral fails and the transaction is shut down. I can't see any reason for the DFS referral to fail. The only reference I can find online is:

https://bugzilla.samba.org/show_bug.cgi?id=8003

Anyone have any ideas for a solution?

Answer 1

Turn on Object Access auditing for both Success and Failure and add auditing entries to the folder/share that the MFC is supposed to be connecting to for the MFC user account that I'm assuming you've created and configured the MFC to use. Then look for events in the Security event log on the server related to the access by the MFC user account.

Answer 2

As mentioned in my followup, I installed Microsoft netmon and captured the packets associated with the transaction. This helped me identify what was going on, however I am unsure of why the DFS referral is being produced. I will deal with this in another question.