I have a similar issue at 2 sites: W10p desktops provisioned from scratch, pulling installation (MSI) binaries from local SAMBA server.
I've created a dedicated share (\nas\provisioning) & tried to be as permissive (chmod & NT ACL's) as I reasonably could - read-only all around for everything & everyone - but I still get what I believe is essentially a permissions issue. Created the GPO's so that the system itself can do the setup, rather than having a (privileged) user account need to log in first to trigger the install.
From what I can gather (and this kinda at the edge of my knowledge on the subject), it seems that the client/guest connects to network (OK), then triggers GPO, calls to server via UNC using what I've learnt in essentially the (local) "NT AUTHOROTY\SYSTEM" (IINM) account to pull binary (eg \nas\provisioning\7zip.msi), but is denied by the server, as it's essentially an unauthenticated connection, rahter than a "known" user, such as Guest or Anonymous.
SAMBA log tells me:
smbd/service.c:627(create_connection_session_info) user 'MYDOMAIN\GUESTHOSTNAME$' (from session setup) not permitted to access this share (provisioning)
smbd/service.c:805(make_connection_snum) create_connection_session_info failed: NT_STATUS_ACCESS_DENIED
smbd/smb2_server.c:2918(smbd_smb2_request_incoming) smbd_smb2_request_incoming: client read error NT_STATUS_CONNECTION_RESET
& with windows logs give me the %%1612 error:
The install of application 7-Zip 16.02 (x64 edition) from policy Install - 7zip failed. The error was : %%1612
meaning it's can't find the resource referenced (because the server's denying it!)
I've even tried tweaking the smb.conf to include wildcards:
valid users = "root","nobody","admin","guest",@"everyone",@"MYDOMAIN\Domain Admins",@"MYDOMAIN\Domain Users",@"MYDOMAIN\Domain Guests",@"MYDOMAIN\Domain Computers",@"MYDOMAIN\*"
I can't imagine this being a new or unique problem, but I can't find a good solution.