Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[jmone]

My "MAIN" PC went to Win11 24H2 a few weeks ago.  Then at some point after this, all my other PC's (Win11 but not 24H2) could no longer access my "Media" share.  In their explorer you can see "Main" but if you click on it then you end up with an error saying "Main" did not respond. 

I've no idea what changed, but have tried:
- Deleting / Adding Shares
- Turning On / Off Windows Defender (no other AV SW is installed) ...this one is for JimH
- I've worked through all the various "fixs" in this thread - https://answers.microsoft.com/en-us/windowsclient/forum/all/windows-11-update-24h2-changes-network-access/e54c583a-7f60-4b84-a7f7-ae2dcafbc85a but nothing makes any difference.

Any other suggestions would be welcome.  No idea what MS have done.  Worked great for a decade +. 

Thanks
Nathan

[jmone]

I should say, it's the worlds simplest "share" with the "everyone" group added (and tried both "read only" and "full access").

[jmone]

...also lost the ability to scan (from a MFD) to a SMB share.

[jmone]

...ahhh, I 'think' it's "mostly" fixed?!?  Not sure why or how.  Twiddled some more settings but nothing too obvious.  Scanner now works, so does as couple of MC Clients.  One is complaining about the "reference account is locked out".  Need to check a couple of others.

How hard can it be to just "share" a folder these days?

[zybex]

This happened to me recently too. I found out the cause was a new network policy setting added by a Windows Update called "Enable insecure guest logons". I had to enable it manually using GPEdit, then it worked again (I use guest/anonymous shares at home).

gpedit.msc:
Computer > Software > Admin Templates > Network > Lanman Workstation > Enable insecure guest logons    [enable]

Also check these:
Computer > Software > Windows > Security > Local Policies > Security Options >
> Network access: Restrict anonymous access to Named Pipes and Shares      [disable]
> Network access: Let Everyone permissions apply to anonymous users          [enable]

Also, make sure your network is still set as "private/home" as Windows sometimes sets it back to Public, causing the firewall to block access to shares.

[jmone]

Thanks, got most of those set, one Q:

Restrict anonymous access to Named Pipes and Shares : Should that be "enabled" or "disabled"?

[zybex]

Disabled.

[Manfred]

Also, make sure your network is still set as "private/home" as Windows sometimes sets it back to Public, causing the firewall to block access to shares.

I had the same problem last year. zybex named root cause also fixed it on my side.

[jmone]

Thanks zybex!  Seems to be up and working again.

@Manfred, yup all were set to private (first thing I checked).  Zybex is right, it is how the latest clamp down has impacted the shares as my "MC Clients" range from dedicated HTPC's to "normal" pc/laptops.  I have a range of MS Accounts, Local Accounts, Pins, Passwords, Autologon across these devices.  Windows 11 24H2 was clearly not happy letting these sort of devices access to the share even if it was set to "everyone".

I miss the simple "Homegroup" days of sharing.

[Richard Martin]

This happened to me recently too. I found out the cause was a new network policy setting added by a Windows Update called "Enable insecure guest logons". I had to enable it manually using GPEdit, then it worked again (I use guest/anonymous shares at home).

gpedit.msc:
Computer > Software > Admin Templates > Network > Lanman Workstation > Enable insecure guest logons    [enable]

Also check these:
Computer > Software > Windows > Security > Local Policies > Security Options >
> Network access: Restrict anonymous access to Named Pipes and Shares      [disable]
> Network access: Let Everyone permissions apply to anonymous users          [enable]

Also, make sure your network is still set as "private/home" as Windows sometimes sets it back to Public, causing the firewall to block access to shares.

Lanman takes me back 30 years to the days when Microsoft bought 3Com's networking software, 3Com 3 Open Plus and renamed it Lan Manager.

[jmone]

Lost access again.  This time it was Windows Defender Firewall where I had to recheck "File and Printer Sharing" to be allowed through the firewall.

I think this time it was due to me diagnosing a 10GBe port on my switch that started to play up (in the end added a 10GBe Distibution switch). 

[jmone]

Mmmm, this is getting out of hand:
- one of the HTPC: Just upgraded to 24/H2 and would not connect to the share on MAIN until I used an account on MAIN
- one of the HTPC: This one is older and still connects fine, but while it is running 23/H2, Windows is now saying it is EOL.

Look like in the new year, I'll have to rethink and redeploy how these clients PC's connect to the MAIN Share primary for MC use.

My basic setup is:
- MAIN PC: This holds the media shares as well as MC (as the server).  It is also my daily driver that I log on to with a 24/H2 MS Account.
- Laptops:  Win 24/H2 with their own MS Account.  I also want them to be able to access the Share on MAIN for MC but they are mostly everyday PC's
- HTPC:  These are SFF with just Local Accounts that are dedicated MC Clients.  I just want these to be able to
   - access the Share on MAIN
   - boot into Windows and MC's Thearview without needing a logon
   - not have access to my MS Account

So.... In this day and age... I'm thinking:
- Upgrade all PC's to 24/H2
- MAIN PC:  Create a Local Account called "MediaCentre"
- HTPC: Change all of them so they have a single but shared MS Account called "MediaCentre" and give that access to the share using the MAIN\MediaCentre credential.  Enable Auto Logon
- Laptops:  Map the meda share on MAIN with the "MAIN\MediaCentre" credential.

Other ideas?

[zybex]

A common account usually works. If you want a blank password you may need to change a policy in GPEdit.

You could also turn your NAS into a local Domain controller, then you'd have real common accounts across your machines. This won't work with Windows Home edition though, as it can't join domains.

[jmone]

Yeah, don't really want to run a domain.  I'm trying to keep it simple as it is already getting out of hand for a home setup!  FWIW, I have PC's autologon with their Account logins and passwords now.

[jmone]

FFS!  It's all stopped working again.  How hard does this have to be.

[zybex]

Maybe the Samba service on the NAS is dying?

[jmone]

...well, I got it going again following this guide bit by bit  - https://www.wintips.org/fix-windows-11-24h2-cannot-access-network-shares-0x80070035/

Not sure yet if all PC and Scanners works but we were trying to watch a movie so stopped at that point.  Will check it more out tmr.

[marko]

FFS!  It's all stopped working again.  How hard does this have to be.

Feeling your pain. Seriously, feeling it.

[jmone]

Feeling your pain. Seriously, feeling it.

It will give me something to do over the holidays! 

[jmone]

FWIW, in addition to the changes suggested by zybex, Disabling these seemed to do the trick (so far anyway):

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options
- Microsoft Network Client: Digitally sign communications (always) : This was already disabled
- Microsoft Network Client: Digitally sign communications (if server agrees) : This was enabled and I changed to disabled

[zybex]

I don't recommend that :-/
Digital signing should always work as long as clients and server (NAS) know the correct date/timestamp.

[jmone]

OK

FWIW - my "NAS" is just my "MAIN" Win 24/H2 PC with a "share" (90TB pool of spinning rust)

[JimH]

Probably old news for you, but Microsoft depreciated support for Samba 1 many years ago because of security concerns.  It could be enabled if necessary.  I don't recall more details.

[jmone]

Yeah, I remember that also bit me at one point.

Anyway, I'm going to do a fresh install in later January and start again.  It's been years.

[zybex]

On a new laptop with Win11 24H2 I had to do these policy changes to enable guest access to the NAS:

(Open gpedit.msc - Local Group policy)

1. Computer Configuration\Administrative Templates\Network\Lanman Workstation
   => Set Enable insecure guest logons to Enabled
   
2. Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options
   => Set Microsoft Network Client: Digitally sign communications (always) to Disabled