problems smb windows 11 use this see link
https://techcommunity.microsoft.com...-smb-in-windows-11-24h2-may-fail/ba-p/4154300
If signing isn't supported by your third-party device, you may get error:
6. Disable the SMB client signing requirement:
a. On the Start Menu search, type gpedit and start the Edit Group Policy app (i.e. Local Group Policy Editor). If you are using Home edition, skip to step 8.
b. In the console tree, select Computer Configuration > Windows Settings > Security Settings> Local Policies > Security Options.
c. Double-click Microsoft network client: Digitally sign communications (always).
d. Select Disabled > OK.
7. Disable the guest fallback protection:
a. On the Start Menu search, type gpedit and start the Edit Group Policy app (i.e. Local Group Policy Editor). If you are using Home edition, skip to step e.
b. In the console tree, select Computer Configuration > Administrative Templates> Network > Lanman Workstation.
c. Double-click Enable insecure guest logons
d. Select Enabled > OK.
8. If you're running Windows 11 Home edition, the guest fallback option is still enabled by default, so you're probably not reading this blog post. But if for some reason it is on, or you need to turn off SMB signing due to some third-party NAS, you will need to use PowerShell to configure your machine because there is no gpedit tool by default. To do this:
a. On the Start Menu search, type powershell then under the Windows PowerShell app, click Run as administrator. Accept the elevation prompt.
b. To disable SMB signing requirement, type:
Set-SmbClientConfiguration -RequireSecuritySignature $false
d. Hit enter, then hit Y to accept.
c. To disable guest fallback, type:
Set-SmbClientConfiguration -EnableInsecureGuestLogons $true
e. Hit enter, then hit Y to accept.
https://techcommunity.microsoft.com...-smb-in-windows-11-24h2-may-fail/ba-p/4154300
What changed
In Windows 11 24H2, we've made two major security changes that can affect mapping drives to third-party consumer NAS or routers with USB storage:- By default, SMB signing is required on all connections. This increases your security by preventing tampering on the network and stops relay attacks that send your credentials to malicious servers.
- Guest fallback is disabled on Windows 11 Pro edition. This increases your security when connecting to untrustworthy devices. Guest allows you to connect to an SMB server with no username or password. While convenient for the maker of your NAS, it means that your device can be tricked into connecting to a malicious server without prompting for credentials, then given ransomware or having your data stolen.
What happens with a third-party NAS
There's one unavoidable consequence, though: we don't know when someone intended to be unsafe.- We don't know the difference between a NAS that doesn't have SMB signing enabled and an evil server that doesn't want SMB signing enabled.
- We also don't know the difference between a consumer NAS - where the manufacturer used guest access to simplify connecting to their storage at the expense of security - and an evil server that wants you to connect without any security prompts in order to steal all of your files and or deliver malware. Furthermore, SMB signing cannot be used with guest credentials. So even if you have guest fallback enabled, SMB signing will prevent it from working.
If signing isn't supported by your third-party device, you may get error:
- 0xc000a000
- -1073700864
- STATUS_INVALID_SIGNATURE
- The cryptographic signature is invalid
- You can't access this shared folder because your organization's security policies block unauthenticated guest access. These policies help protect your PC from unsafe or malicious devices on the network
- 0x80070035
- 0x800704f8
- The network path was not found
- System error 3227320323 has occurred
How to solve the issues
To solve these issues, we recommend you do the following in this order. It's ordered from the safest to the least safe approach, and our goal is for your data to be protected, not to help third parties sell you unsafe products.- Enable SMB signing in your third-party NAS. Your vendor will have steps to do this online if it's possible in the device's management software.
- Disable guest access in your third-party NAS. Your vendor will have steps to do this online if it's possible in the device's management software.
- Enable a username and password in your third-party NAS. Your vendor will have steps to do this online if it's possible in the device's management software.
- Upgrade your NAS if you cannot enable signing, cannot disable guest, or cannot use a username and password. The NAS will usually have an upgrade option in its management software, possibly labeled as "firmware update."
- Replace your NAS if you cannot upgrade your NAS software to support signing and credentials (you will need to use steps 6 and later to copy your data off of it to your new NAS first)
6. Disable the SMB client signing requirement:
a. On the Start Menu search, type gpedit and start the Edit Group Policy app (i.e. Local Group Policy Editor). If you are using Home edition, skip to step 8.
b. In the console tree, select Computer Configuration > Windows Settings > Security Settings> Local Policies > Security Options.
c. Double-click Microsoft network client: Digitally sign communications (always).
d. Select Disabled > OK.
7. Disable the guest fallback protection:
a. On the Start Menu search, type gpedit and start the Edit Group Policy app (i.e. Local Group Policy Editor). If you are using Home edition, skip to step e.
b. In the console tree, select Computer Configuration > Administrative Templates> Network > Lanman Workstation.
c. Double-click Enable insecure guest logons
d. Select Enabled > OK.
8. If you're running Windows 11 Home edition, the guest fallback option is still enabled by default, so you're probably not reading this blog post. But if for some reason it is on, or you need to turn off SMB signing due to some third-party NAS, you will need to use PowerShell to configure your machine because there is no gpedit tool by default. To do this:
a. On the Start Menu search, type powershell then under the Windows PowerShell app, click Run as administrator. Accept the elevation prompt.
b. To disable SMB signing requirement, type:
Set-SmbClientConfiguration -RequireSecuritySignature $false
d. Hit enter, then hit Y to accept.
c. To disable guest fallback, type:
Set-SmbClientConfiguration -EnableInsecureGuestLogons $true
e. Hit enter, then hit Y to accept.
Last edited:
