Guest access in SMB2 disabled by default in Windows 10

Guest Access In SMB2 Disabled By Default In Windows 10

Problem description

In Windows 10, version 1709, Windows 10, version 1903, Windows Server, version 1709, Windows Server, version 1903, and Windows Server 2019, the SMB2 client no longer allows the following actions:

Guest account access to a remote server
Fallback to the Guest account after invalid credentials are provided

SMBv2 has the following behavior in these versions of Windows:

Windows 10 Enterprise and Windows 10 Education no longer allow a user to connect to a remote share by using guest credentials by default, even if the remote server requests guest credentials.
Windows Server 2016 Datacenter and Standard edition no longer allow a user to connect to a remote share by using guest credentials by default, even if the remote server requests guest credentials.
Windows 10 Home and Professional editions are unchanged from their previous default behavior.

If you try to connect to Nodeum with local user definition and where your login user is not defined into Nodeum, you may receive the following error message:

You can't access this shared folder because your organization's security policies block unauthenticated guest access. These policies help protect your PC from unsafe or malicious devices on the network.

Resolutions

Solution 1

You need to map a Nodeum shared folder with a local network letter in using different credential (username-password). You have to use username which is defined into Nodeum. Once done, this mapping will be defined and you will get access to Nodeum with this letter. But in conjunction, this credential will be memorize by Windows and will let display all Network Shared Folders available and access it.

Solution 2

Re-Enable the guest account fallback ,

Go into Local Group Policy Editor
Navigate into Administrative Templates - Network - Lanman Workstation.
Then the Setting : Enable insecure guest logons has to be set to "Enable".
1. Enable : Allow guest usage and solve the problem
2. Disable : Will not allow guest usage and provide this problem.

enable insecure guest logons

Solution 3

Change the Samba "map to guest" parameter into Nodeum. Standard setting by default is "map to guest = bad user". This setting sets a guest session flag during initial SMB tree connect, and the listed Windows versions can end up failing to establish a session.

When changed to "map to guest = Never", then instead of silently dropping the connection, the Windows client prompts for a password.

This change works even if the "enable insecure guest logons is set to Disable".

edit /etc/samba/smb.conf
change the line as described here below :

After the change

...
#map to guest = Bad User
map to guest = Never
map archive = no
map system = no
map hidden = no
map read only = no
map untrusted to domain = yes
...

reload Samba : service smb restart

A behavior is to not allow any more the parameter "allow guest access" on share.

Related Categories

Knowledge Base

Subscribe to Email Updates

Guest access in SMB2 disabled by default in Windows 10

Guest Access In SMB2 Disabled By Default In Windows 10

Problem description