16

A few PCs that have Windows 10 1709 installed (instead of upgraded from 1703) are having trouble connecting to network shares running on Samba (Ubuntu 17.10). Entries in event logs indicate that the cause seems to be that Windows 10 1709 disabled guest access.

Originally, the share itself was protected but guests can browse what shares are available by connecting to \\samba.company.com. I added restrict anonymous = 2 to smb.conf and now Windows Explorer prompts for sign in when accessing \\samba.company.com. However, those Windows 10 1709 PCs are still having trouble connecting to the Samba shares.

Most of the articles I found talk about enabling guest access on Windows 10. Is it possible to disable guest access on Samba instead?

13

For security reasons Microsoft has disabled the SMB 2 guest access. You are right that you can change the Windows settings to allow the guest access to the samba share.

https://tech.nicolonsky.ch/windows-10-1709-cannot-access-smb2-share-guest-access/

https://support.microsoft.com/de-ch/help/4046019/guest-access-smb2-disabled-by-default-in-windows-10-server-2016

You can change GPO settings to allow this. However, you can force use SMB 3.0 on samba site (will work if all your clients support SMB 3 protocol) as an example:

client min protocol = SMB3
client max protocol = SMB3
| improve this answer | |
  • 1
    My smb.conf has min protocol = SMB3, and I added the two lines in your answer and restarted Samba. However, I'm still getting the "Rejected an insecure guest logon" error in Windows 10. – Jim Feb 6 '18 at 6:15
  • 1
    Have you tried to change the windows settings? – Net Runner Feb 6 '18 at 12:59
  • 1
    I know i can enable insecure guess access on Windows. My goal was to not change Windows settings but change Samba settings to disable insecure guess access. – Jim Feb 7 '18 at 6:22
  • 3
    Unfortunately, Samba is still not completely compatible with SMB3.0 and it's dialects that might cause authentication issues. I would still recommend you to try enabling Windows insecure access just to check if it works to ensure that is the issue. Most probably you will have to sacrifice security settings in order to get this working anyways. – Net Runner Feb 7 '18 at 7:24
  • 1
    Ah that makes sense and I assume that might be the cause. I have already tried and I know changing Windows 10 settings would work (in fact any PC that was updated from 1703 works). I just want to know if there is a way to change Samba's behavior so we don't have to downgrade (for lack of better words) the security settings on Windows 10. – Jim Feb 7 '18 at 12:51
2

If changing GPO Setting still does not work, which is in my case, then you need to:

Control Panel->Turn windows features on or off->Find and check the option "SMB 1.0/CIFS Client"

| improve this answer | |
  • This was the fix for me. A brand new Windows 10 Pro install, connecting to an Ubuntu 18.10 Samba share configured via right-click "Local Network Share". Not sure why the downvote (I got it back to zero at least). – Dave Sep 16 '18 at 22:04
2

insecure guest logins got disabled by default in Creators update.

enable it in Local Group Policy Editor

Computer configuration\administrative templates\network\Lanman Workstation
"Enable insecure guest logons"
| improve this answer | |
2

To work I needed to add in my smb.conf

server min protocol = SMB2_10
client min protocol = SMB2
client max protocol = SMB3
ntlm auth = yes 
| improve this answer | |
  • This worked for me! Thx – Michael Oct 12 '19 at 12:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.