I have a service that needs to establish a SMB connection to several servers. There is no issue with domain-joined computers using a domain account with access. However, I need it to connect to a few servers that are not joined.
- The service needs Admin privileges to the Admin$ share.
- The built-in Administrator account is disabled.
- I have the created Local Admin username and password.
- Windows Firewall is off.
- Servers are on the same subnet, no firewall between them.
Initially NTLM was set to DENY ALL, and I never got a connection. When I stepped the setting "down" to DENY ALL DOMAIN ACCOUNTS I was finally able to connect to a test server. However when I made the same change to a production server, I could not connect.
It took a while, but I realized I was using the built-in Administrator account on the test system. We disable this built-in account on all of our production servers, and create a new account that is added to the local Administrators group.
If enabled, I can connect using the built-in Administrator account.
C:\Windows\system32>net use \\Server\Admin$ /USER:Administrator P@$$w0rd1
The command completed successfully.
However, using any other members of the local Administrators group, I cannot connect.
C:\Windows\system32>net use \\Server\Admin$ /USER:NewAdmin NewP@$$wd
System error 5 has occurred.
Access is denied
Any guidance appreciated.