2

I have a similar issue at 2 sites: W10p desktops provisioned from scratch, pulling installation (MSI) binaries from local SAMBA server.

I've created a dedicated share (\nas\provisioning) & tried to be as permissive (chmod & NT ACL's) as I reasonably could - read-only all around for everything & everyone - but I still get what I believe is essentially a permissions issue. Created the GPO's so that the system itself can do the setup, rather than having a (privileged) user account need to log in first to trigger the install.

From what I can gather (and this kinda at the edge of my knowledge on the subject), it seems that the client/guest connects to network (OK), then triggers GPO, calls to server via UNC using what I've learnt in essentially the (local) "NT AUTHOROTY\SYSTEM" (IINM) account to pull binary (eg \nas\provisioning\7zip.msi), but is denied by the server, as it's essentially an unauthenticated connection, rahter than a "known" user, such as Guest or Anonymous.

SAMBA log tells me:

smbd/service.c:627(create_connection_session_info) user 'MYDOMAIN\GUESTHOSTNAME$' (from session setup) not permitted to access this share (provisioning)

smbd/service.c:805(make_connection_snum) create_connection_session_info failed: NT_STATUS_ACCESS_DENIED

smbd/smb2_server.c:2918(smbd_smb2_request_incoming) smbd_smb2_request_incoming: client read error NT_STATUS_CONNECTION_RESET

& with windows logs give me the %%1612 error:

The install of application 7-Zip 16.02 (x64 edition) from policy Install - 7zip failed. The error was : %%1612

meaning it's can't find the resource referenced (because the server's denying it!)

I've even tried tweaking the smb.conf to include wildcards:

valid users = "root","nobody","admin","guest",@"everyone",@"MYDOMAIN\Domain Admins",@"MYDOMAIN\Domain Users",@"MYDOMAIN\Domain Guests",@"MYDOMAIN\Domain Computers",@"MYDOMAIN\*"

I can't imagine this being a new or unique problem, but I can't find a good solution.

1 Answer 1

1

If your Samba server is allowing unauthenticated guest access, newer Windows versions refuse to connect to it.

This addresses how to fix the Samba configuration in that case, if on a domain.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .