22

A few PCs that have Windows 10 1709 installed (instead of upgraded from 1703) are having trouble connecting to network shares running on Samba (Ubuntu 17.10). Entries in event logs indicate that the cause seems to be that Windows 10 1709 disabled guest access.

Originally, the share itself was protected but guests can browse what shares are available by connecting to \\samba.company.com. I added restrict anonymous = 2 to smb.conf and now Windows Explorer prompts for sign in when accessing \\samba.company.com. However, those Windows 10 1709 PCs are still having trouble connecting to the Samba shares.

Most of the articles I found talk about enabling guest access on Windows 10. Is it possible to disable guest access on Samba instead?

Improve this question
1
  • This comment is long overdue, but I was able to resolve the issue entirely on Ubuntu by following askubuntu.com/a/1145981/156790, which involves removing all map to guest in smb.conf.
    – Jim
    Aug 10, 2021 at 13:32

4 Answers 4

Reset to default
17

For security reasons Microsoft has disabled the SMB 2 guest access. You are right that you can change the Windows settings to allow the guest access to the samba share.

https://tech.nicolonsky.ch/windows-10-1709-cannot-access-smb2-share-guest-access/

https://support.microsoft.com/de-ch/help/4046019/guest-access-smb2-disabled-by-default-in-windows-10-server-2016

You can change GPO settings to allow this. However, you can force use SMB 3.0 on samba site (will work if all your clients support SMB 3 protocol) as an example:

client min protocol = SMB3
client max protocol = SMB3
Improve this answer
5
  • 2
    My smb.conf has min protocol = SMB3, and I added the two lines in your answer and restarted Samba. However, I'm still getting the "Rejected an insecure guest logon" error in Windows 10.
    – Jim
    Feb 6, 2018 at 6:15
  • 2
    Have you tried to change the windows settings?
    – Net Runner
    Feb 6, 2018 at 12:59
  • 1
    I know i can enable insecure guess access on Windows. My goal was to not change Windows settings but change Samba settings to disable insecure guess access.
    – Jim
    Feb 7, 2018 at 6:22
  • 4
    Unfortunately, Samba is still not completely compatible with SMB3.0 and it's dialects that might cause authentication issues. I would still recommend you to try enabling Windows insecure access just to check if it works to ensure that is the issue. Most probably you will have to sacrifice security settings in order to get this working anyways.
    – Net Runner
    Feb 7, 2018 at 7:24
  • 1
    Ah that makes sense and I assume that might be the cause. I have already tried and I know changing Windows 10 settings would work (in fact any PC that was updated from 1703 works). I just want to know if there is a way to change Samba's behavior so we don't have to downgrade (for lack of better words) the security settings on Windows 10.
    – Jim
    Feb 7, 2018 at 12:51
5

To work I needed to add in my smb.conf

server min protocol = SMB2_10
client min protocol = SMB2
client max protocol = SMB3
ntlm auth = yes
Improve this answer
3
  • This worked for me! Thx
    – Michael
    Oct 12, 2019 at 12:55
  • Thankyou! Thats what worked for me! :-)
    – firecall
    Jan 31, 2021 at 7:55
  • Thank you.. I had to add these to make both cifs.mount and windows 10 clients happy.
    – Adarsha
    Jun 5, 2021 at 17:25
3

insecure guest logins got disabled by default in Creators update.

enable it in Local Group Policy Editor

Computer configuration\administrative templates\network\Lanman Workstation
"Enable insecure guest logons"
Improve this answer
3

If changing GPO Setting still does not work, which is in my case, then you need to:

Control Panel->Programs and Features->Turn windows features on or off->Find and check the option "SMB 1.0/CIFS Client"

Improve this answer
1
  • 1
    This was the fix for me. A brand new Windows 10 Pro install, connecting to an Ubuntu 18.10 Samba share configured via right-click "Local Network Share". Not sure why the downvote (I got it back to zero at least).
    – Dave
    Sep 16, 2018 at 22:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .