Cannot access SMB

[spiceuser-4nrt]

Hello,
I’ve got a weird problem on a Windows Server 2019 file server:

Local users can open SMB share located in Windows server.

Domain users get an error (NTFS and sharing permissions= Everyone):
\172.16. is not accessible. You might not have permission to use this network resource. Contact the administrator of this server to find out if you have access permissions.

The request is not supported.

Remote Desktop works fine for both accounts (Domain users and local users)

Ping to domain works. Telnet 445 works.

Please your help.

[agenglercain]

Been there done that!!

Control SMB signing behavior

And

Enable insecure guest logons in SMB2 and SMB3 for Windows client and Windows...

[ode2joy]

Just an FYI, I know you tried scrubbing your text of the full IP address, but it’s still visible in your first screenshot.

[Rod-IT]

@spiceuser-4nrt

(NTFS and sharing permissions= Everyone)

From a security perspective this is a bad idea.

It seems like you may have SMB signing enabled on the server, but not on the client, check your GPO for signing enforcement.

[Jay-Updegrove]

Is there a reason you’re using SMB in the first place? There are better connection options available…now is a good time to start researching alternatives nothing like an emergency outage to gain traction on a project!

[Rod-IT]

@Jay-Updegrove

Is there a reason you’re using SMB in the first place?

SMB is CIFS (\server\share), in itself this is expected, but SMB 1.0 shouldn’t be used.

[naveenkatikam]

Try SMB 1.0 CIFS or disable Microsoft network client: Digitally sign communications(always)

[adrian_ych]

Did you “enable” local firewall for SMB, printer & file sharing on the local server especially for Domain profile ?

[Rod-IT]

@naveenkatikam

As I posted over here too:

Windows file sharing issue

Please don’t. Enabling legacy protocols is a BAD idea. Even more so since both devices are Windows 11 and support SMB 3.1.1 by default.

Please don’t suggest this, that’s bad practise and likely NOT the issue.

Both systems are new and should support SMB 3.1, turning on legacy systems is a very bad idea.

Turning off signing is also a bad idea, I’m not sure why you would be suggesting bad practises.

[matt7863 (m@ttshaw)]

add domain users and see if it fixes.
you could also add the local users group and remove everyone.

‘Everyone’ requires the local guest account to be enabled - and is not recommended as it is a security risk.