✅Scan to Network Folder (HP DesignJet): "Incorrect credentials..."

[bzit]

When attempting to set up a scan to network function to allow a HP DesignJet T830 to scan to a Windows 2008 Server, I’m getting an error:

Incorrect credentials. Check your username/password and try again.

When I attempt to connect to the Windows 2008 Server with the same user account from another Windows 10 computer on the network from cmd.exe it does succeed:

C:\Windows\System32>net use z: "\\192.168.0.10\share\path" /persistent:no PASSWD /user:share_username
The command completed successfully.

C:\Windows\System32>net use z: /delete
z: was deleted successfully.

When I attempt to connect with the same settings from the printer’s admin interface it simply fails with the initial message. I have also attempted to use the domain prepended as well, eg: DOMAIN\share_username.

I will paste below the entries in Event Viewer\Security (both “Audit Success” and the 2 "Audit Failure"s) and from the Windows 2008 Server for each entry:

This is the successful Windows 10 cmd.exe connection as per above’s example code as found in Event Viewer:

An account was successfully logged on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Type:			3

New Logon:
	Security ID:		DOMAIN\share_username
	Account Name:		share_username
	Account Domain:		MYDOMAIN
	Logon ID:		0x3e47ead3
	Logon GUID:		{00000000-0000-0000-0000-000000000000}

Process Information:
	Process ID:		0x0
	Process Name:		-

Network Information:
	Workstation Name:	WIN10-TESTER
	Source Network Address:	192.168.0.101
	Source Port:		60914

Detailed Authentication Information:
	Logon Process:		NtLmSsp 
	Authentication Package:	NTLM
	Transited Services:	-
	Package Name (NTLM only):	NTLM V2
	Key Length:		128

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
	- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

Attempt 1 from HP DesignJet Printer with username sans domain:

An account failed to log on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Type:			3

Account For Which Logon Failed:
	Security ID:		NULL SID
	Account Name:		share_username
	Account Domain:		WORKGROUP

Failure Information:
	Failure Reason:		Unknown user name or bad password.
	Status:			0xc000006d
	Sub Status:		0xc000006a

Process Information:
	Caller Process ID:	0x0
	Caller Process Name:	-

Network Information:
	Workstation Name:	HPDEJET
	Source Network Address:	192.168.0.53
	Source Port:		56323

Detailed Authentication Information:
	Logon Process:		NtLmSsp 
	Authentication Package:	NTLM
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

Attempt 2 from HP DesignJet Printer with username AND domain (eg, MYDOMAIN\share_username):

An account failed to log on.

Subject:
	Security ID:		NULL SID
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Type:			3

Account For Which Logon Failed:
	Security ID:		NULL SID
	Account Name:		share_username
	Account Domain:		MYDOMAIN

Failure Information:
	Failure Reason:		Unknown user name or bad password.
	Status:			0xc000006d
	Sub Status:		0xc000006a

Process Information:NN
	Caller Process ID:	0x0
	Caller Process Name:	-

Network Information:
	Workstation Name:	HPDEJET
	Source Network Address:	192.168.0.53
	Source Port:		56330

Detailed Authentication Information:
	Logon Process:		NtLmSsp 
	Authentication Package:	NTLM
	Transited Services:	-
	Package Name (NTLM only):	-
	Key Length:		0

This event is generated when a logon request fails. It is generated on the computer where access was attempted.

The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).

The Process Information fields indicate which account and process on the system requested the logon.

The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
	- Transited services indicate which intermediate services have participated in this logon request.
	- Package name indicates which sub-protocol was used among the NTLM protocols.
	- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

For thoroughness, here are the HP DesignJet’s web admin configuration pages pertaining unto the above:

[da-schmoo]

First thing that comes to mind is an SMB issue. The scanner only supports SMB1 and that’s disabled on the server? (or SMB 2/3 needing to be enabled on the printer or a firmware update needed?) Or the opposite - the scanner only supports SMB2/3 and that’s not enabled on the server?

I’ve also seen some HP devices only wanting to scan to the top of the share - \server_IP\share works whereas \server_IP\share\scans does not.

[jessevas]

Is this a new setup, or is this problem occurring from a printer which succeeded in the past? If its a new setup, I would start by double-checking the DC to be sure there aren’t any group or client settings preventing access in order to verify credentials.

[big-green-man]

@da-schmoo

First thing that comes to mind is an SMB issue. The scanner only supports SMB1 and that’s disabled on the server? (or SMB 2/3 needing to be enabled on the printer or a firmware update needed?) Or the opposite - the scanner only supports SMB2/3 and that’s not enabled on the server?

I’ve also seen some HP devices only wanting to scan to the top of the share - \server_IP\share works whereas \server_IP\share\scans does not.

I would also make sure the account explicitly has write permissions to the share. I’ve seen it fail when the user is in a security group and that group has write permissions, but it will succeed if the user account is given write permissions instead.

[bzit]

Thanks folks, turns out that I forced SMB1 and 2+3 to be enabled as a sanity check on the server via elevated (admin) PowerShell:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB1 -Type DWORD -Value 1 -Force

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB2 -Type DWORD -Value 1 -Force

Rebooted the server and voila, the user was able to connect without any further trouble. I kinda had a hunch about this too @da-schmoo ​ and I appreciate your suggestion, but it was working just several months prior, so it was discombobulating to experience this and I can only suspect a firmware issue on the plotter.