1

I've got one Server 2012 server in the domain. I set up a single shared folder on it. I then tested it from my workstation (8.1) - this worked great.

But then I got complaints from various users saying they can't access the shared folder. It turns out that Windows 7 clients (which is a several) can't access the shared folder. When I remoted into one of their machines, I saw that going to "\SERVERNAME" in explorer causes a Windows Security dialog to pop up asking for a username & password. Entering the correct username & password doesn't do anything - the security prompt just re-appears.

I have done all the basic troubleshooting - double checked permissions, verified connectivity and DNS etc. I doubt these are the issue anyway because Win 8.1/10 boxes can access this shared folder just fine. As can other Server 2012/2012 R2 boxes. However, I can't access the shared folder from Server 2008 R2 boxes either (same security dialog). Again this is problematic since we have 2008 R2 terminal servers which can't access this share hosted on the 2012 Server. I can't even net view. here's what I get when I "Net view \SERVERNAME" from a Win 7 Client:

 System error 5 has occurred.
 Access is denied.

Completely out of ideas at this time. What could prevent Win 7/Server 2008 R2 from being able to access a share hosted on a Server 2012 box? Win 8.1/10 Clients can access it fine.

Everything's all patched up to the latest versions.

  • Does by Ip it work to list the share atleast ? – yagmoth555 Jul 16 '17 at 17:41
  • I'd start with a network trace taken while reproducing the error. – Ryan Ries Jul 16 '17 at 23:39
1

Ok - it looks like the issue is that this server has Encrypted file share access enabled (see this).

It appears that when this is enabled, the server uses SMB 3.0 exclusively and will reject connections from clients that don't have SMB 3.0 (i.e. anything versions of Windows 7 or earlier and any versions of Windows Server 2008 R2 and earlier).

The "Fix" is to upgrade clients to at least Windows 8, and servers to at least Windows 2012. Disabling encryption is also possible by a powershell command:

Set-SmbServerConfiguration –RejectUnencryptedAccess $false  

(it will allow the client accessing the share to re-negotiate to a lower version of SMB like SMB 2, but obviously this should be avoided if possible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.