15

A few PCs that have Windows 10 1709 installed (instead of upgraded from 1703) are having trouble connecting to network shares running on Samba (Ubuntu 17.10). Entries in event logs indicate that the cause seems to be that Windows 10 1709 disabled guest access.

Originally, the share itself was protected but guests can browse what shares are available by connecting to \\samba.company.com. I added restrict anonymous = 2 to smb.conf and now Windows Explorer prompts for sign in when accessing \\samba.company.com. However, those Windows 10 1709 PCs are still having trouble connecting to the Samba shares.

Most of the articles I found talk about enabling guest access on Windows 10. Is it possible to disable guest access on Samba instead?

13

For security reasons Microsoft has disabled the SMB 2 guest access. You are right that you can change the Windows settings to allow the guest access to the samba share.

https://tech.nicolonsky.ch/windows-10-1709-cannot-access-smb2-share-guest-access/

https://support.microsoft.com/de-ch/help/4046019/guest-access-smb2-disabled-by-default-in-windows-10-server-2016

You can change GPO settings to allow this. However, you can force use SMB 3.0 on samba site (will work if all your clients support SMB 3 protocol) as an example:

client min protocol = SMB3
client max protocol = SMB3
  • 1
    My smb.conf has min protocol = SMB3, and I added the two lines in your answer and restarted Samba. However, I'm still getting the "Rejected an insecure guest logon" error in Windows 10. – Jim Feb 6 '18 at 6:15
  • 1
    Have you tried to change the windows settings? – Net Runner Feb 6 '18 at 12:59
  • 1
    I know i can enable insecure guess access on Windows. My goal was to not change Windows settings but change Samba settings to disable insecure guess access. – Jim Feb 7 '18 at 6:22
  • 3
    Unfortunately, Samba is still not completely compatible with SMB3.0 and it's dialects that might cause authentication issues. I would still recommend you to try enabling Windows insecure access just to check if it works to ensure that is the issue. Most probably you will have to sacrifice security settings in order to get this working anyways. – Net Runner Feb 7 '18 at 7:24
  • 1
    Ah that makes sense and I assume that might be the cause. I have already tried and I know changing Windows 10 settings would work (in fact any PC that was updated from 1703 works). I just want to know if there is a way to change Samba's behavior so we don't have to downgrade (for lack of better words) the security settings on Windows 10. – Jim Feb 7 '18 at 12:51
2

If changing GPO Setting still does not work, which is in my case, then you need to:

Control Panel->Turn windows features on or off->Find and check the option "SMB 1.0/CIFS Client"

  • This was the fix for me. A brand new Windows 10 Pro install, connecting to an Ubuntu 18.10 Samba share configured via right-click "Local Network Share". Not sure why the downvote (I got it back to zero at least). – Dave Sep 16 '18 at 22:04
1

To work I needed to add in my smb.conf

server min protocol = SMB2_10
client min protocol = SMB2
client max protocol = SMB3
ntlm auth = yes 
0

insecure guest logins got disabled by default in Creators update.

enable it in Local Group Policy Editor

Computer configuration\administrative templates\network\Lanman Workstation
"Enable insecure guest logons"

protected by Community Jul 12 at 18:08

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.