What could prevent Windows 7/Server 2008 R2 from being able to access a share hosted on a Server 2012 box? Win 8.1/10 Clients can access it fine

Question

I've got one Server 2012 server in the domain. I set up a single shared folder on it. I then tested it from my workstation (8.1) - this worked great.

But then I got complaints from various users saying they can't access the shared folder. It turns out that Windows 7 clients (which is a several) can't access the shared folder. When I remoted into one of their machines, I saw that going to "\SERVERNAME" in explorer causes a Windows Security dialog to pop up asking for a username & password. Entering the correct username & password doesn't do anything - the security prompt just re-appears.

I have done all the basic troubleshooting - double checked permissions, verified connectivity and DNS etc. I doubt these are the issue anyway because Win 8.1/10 boxes can access this shared folder just fine. As can other Server 2012/2012 R2 boxes. However, I can't access the shared folder from Server 2008 R2 boxes either (same security dialog). Again this is problematic since we have 2008 R2 terminal servers which can't access this share hosted on the 2012 Server. I can't even net view. here's what I get when I "Net view \SERVERNAME" from a Win 7 Client:

 System error 5 has occurred.
 Access is denied.

Completely out of ideas at this time. What could prevent Win 7/Server 2008 R2 from being able to access a share hosted on a Server 2012 box? Win 8.1/10 Clients can access it fine.

Everything's all patched up to the latest versions.

Answer 1

Ok - it looks like the issue is that this server has Encrypted file share access enabled (see this).

It appears that when this is enabled, the server uses SMB 3.0 exclusively and will reject connections from clients that don't have SMB 3.0 (i.e. anything versions of Windows 7 or earlier and any versions of Windows Server 2008 R2 and earlier).

The "Fix" is to upgrade clients to at least Windows 8, and servers to at least Windows 2012. Disabling encryption is also possible by a powershell command:

Set-SmbServerConfiguration –RejectUnencryptedAccess $false  

(it will allow the client accessing the share to re-negotiate to a lower version of SMB like SMB 2, but obviously this should be avoided if possible.