20

A few PCs that have Windows 10 1709 installed (instead of upgraded from 1703) are having trouble connecting to network shares running on Samba (Ubuntu 17.10). Entries in event logs indicate that the cause seems to be that Windows 10 1709 disabled guest access.

Originally, the share itself was protected but guests can browse what shares are available by connecting to \\samba.company.com. I added restrict anonymous = 2 to smb.conf and now Windows Explorer prompts for sign in when accessing \\samba.company.com. However, those Windows 10 1709 PCs are still having trouble connecting to the Samba shares.

Most of the articles I found talk about enabling guest access on Windows 10. Is it possible to disable guest access on Samba instead?

Jim
  • 629
  • 2
  • 7
  • 20
  • This comment is long overdue, but I was able to resolve the issue entirely on Ubuntu by following https://askubuntu.com/a/1145981/156790, which involves removing all `map to guest` in `smb.conf`. – Jim Aug 10 '21 at 13:32

4 Answers4

17

For security reasons Microsoft has disabled the SMB 2 guest access. You are right that you can change the Windows settings to allow the guest access to the samba share.

https://tech.nicolonsky.ch/windows-10-1709-cannot-access-smb2-share-guest-access/

https://support.microsoft.com/de-ch/help/4046019/guest-access-smb2-disabled-by-default-in-windows-10-server-2016

You can change GPO settings to allow this. However, you can force use SMB 3.0 on samba site (will work if all your clients support SMB 3 protocol) as an example:

client min protocol = SMB3
client max protocol = SMB3
Net Runner
  • 5,626
  • 11
  • 29
  • 2
    My **smb.conf** has **min protocol = SMB3**, and I added the two lines in your answer and restarted Samba. However, I'm still getting the "Rejected an insecure guest logon" error in Windows 10. – Jim Feb 06 '18 at 06:15
  • 2
    Have you tried to change the windows settings? – Net Runner Feb 06 '18 at 12:59
  • 1
    I know i can enable insecure guess access on Windows. My goal was to not change Windows settings but change Samba settings to disable insecure guess access. – Jim Feb 07 '18 at 06:22
  • 4
    Unfortunately, Samba is still not completely compatible with SMB3.0 and it's dialects that might cause authentication issues. I would still recommend you to try enabling Windows insecure access just to check if it works to ensure that is the issue. Most probably you will have to sacrifice security settings in order to get this working anyways. – Net Runner Feb 07 '18 at 07:24
  • 1
    Ah that makes sense and I assume that might be the cause. I have already tried and I know changing Windows 10 settings would work (in fact any PC that was updated from 1703 works). I just want to know if there is a way to change Samba's behavior so we don't have to downgrade (for lack of better words) the security settings on Windows 10. – Jim Feb 07 '18 at 12:51
4

To work I needed to add in my smb.conf

server min protocol = SMB2_10
client min protocol = SMB2
client max protocol = SMB3
ntlm auth = yes
Eric Ze
  • 41
  • 1
3

If changing GPO Setting still does not work, which is in my case, then you need to:

Control Panel->Programs and Features->Turn windows features on or off->Find and check the option "SMB 1.0/CIFS Client"

Vince
  • 3
  • 2
ppau2004
  • 41
  • 6
  • 1
    This was the fix for me. A brand new Windows 10 Pro install, connecting to an Ubuntu 18.10 Samba share configured via right-click "Local Network Share". Not sure why the downvote (I got it back to zero at least). – Dave Sep 16 '18 at 22:04
2

insecure guest logins got disabled by default in Creators update.

enable it in Local Group Policy Editor

Computer configuration\administrative templates\network\Lanman Workstation
"Enable insecure guest logons"
Bozojoe
  • 587
  • 5
  • 17