Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am attempting to setup network scanning on a brother MFC-9970CDW printer. According to the Brother documentation, the printer is setup to connect to any CIFS network share. I applied all of the appropriate setting in the printer however I get a "sending error" when I try to scan a document.

When I look at the logs of the 2008 R2 server that I am attempting to connect to; I can see in the security log where the printer successfully authenticates, however nothing else is logged.

I would assume that immediately after the authentication, the printer is making a CIFS request and some sort of error is occurring, however I can't seem to find any way to log this information to find out what is going on. Is it possible to get Windows 2008 to log SMB/CIFS traffic?


I installed Microsoft netmon and captured the packets associated with the transaction:

510 3:04:28 PM 7/9/2012 34.4277743  System    SMB SMB:C; Negotiate, Dialect = NT LM 0.12  {SMBOverTCP:30, TCP:29, IPv4:22}
511 3:04:28 PM 7/9/2012 34.4281246  System   SMB SMB:R; Negotiate, Dialect is NT LM 0.12 (#0), SpnegoToken (   {SMBOverTCP:30, TCP:29, IPv4:22}
519 3:04:29 PM 7/9/2012 34.8986214  System    SMB SMB:C; Session Setup Andx, NTLM NEGOTIATE MESSAGE   {SMBOverTCP:30, TCP:29, IPv4:22}
520 3:04:29 PM 7/9/2012 34.8989310  System   SMB SMB:R; Session Setup Andx, NTLM CHALLENGE MESSAGE - NT Status: System - Error, Code = (22) STATUS_MORE_PROCESSING_REQUIRED  {SMBOverTCP:30, TCP:29, IPv4:22}
522 3:04:29 PM 7/9/2012 34.9022870  System    SMB SMB:C; Session Setup Andx, NTLM AUTHENTICATE MESSAGEVersion:v2, Domain: CORP, User: PRINTSUPOFF, Workstation: BRN001BA9AD1FE6   {SMBOverTCP:30, TCP:29, IPv4:22}
523 3:04:29 PM 7/9/2012 34.9032421  System   SMB SMB:R; Session Setup Andx   {SMBOverTCP:30, TCP:29, IPv4:22}
525 3:04:29 PM 7/9/2012 34.9051855  System    SMB SMB:C; Tree Connect Andx, Path = \\\IPC$, Service = ?????   {SMBOverTCP:30, TCP:29, IPv4:22}
526 3:04:29 PM 7/9/2012 34.9053083  System   SMB SMB:R; Tree Connect Andx, Service = IPC {SMBOverTCP:30, TCP:29, IPv4:22}
528 3:04:29 PM 7/9/2012 34.9073573  System    DFSC    DFSC:Get DFS Referral Request, FileName: \\\NSCFILES, MaxReferralLevel: 3   {SMB:33, SMBOverTCP:30, TCP:29, IPv4:22}
529 3:04:29 PM 7/9/2012 34.9152042  System   SMB SMB:R; Transact2, Get Dfs Referral - NT Status: System - Error, Code = (549) STATUS_NOT_FOUND   {SMB:33, SMBOverTCP:30, TCP:29, IPv4:22}
531 3:04:29 PM 7/9/2012 34.9169738  System    SMB SMB:C; Tree Disconnect  {SMBOverTCP:30, TCP:29, IPv4:22}
532 3:04:29 PM 7/9/2012 34.9170688  System   SMB SMB:R; Tree Disconnect  {SMBOverTCP:30, TCP:29, IPv4:22}

As you can see, the DFS referral fails and the transaction is shut down. I can't see any reason for the DFS referral to fail. The only reference I can find online is:

Anyone have any ideas for a solution?

share|improve this question
try googling for SMB signing version... can't quite emember, but it could be that 2008R2 is requiring a higher level of SMB signing than the client can support, you can lower it through GPO or local policy – SpacemanSpiff Jul 9 '12 at 16:20

Turn on Object Access auditing for both Success and Failure and add auditing entries to the folder/share that the MFC is supposed to be connecting to for the MFC user account that I'm assuming you've created and configured the MFC to use. Then look for events in the Security event log on the server related to the access by the MFC user account.

share|improve this answer

As mentioned in my followup, I installed Microsoft netmon and captured the packets associated with the transaction. This helped me identify what was going on, however I am unsure of why the DFS referral is being produced. I will deal with this in another question.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.