Samba – How to Configure Samba to Work with Windows 10 1709

sambasamba4

A few PCs that have Windows 10 1709 installed (instead of upgraded from 1703) are having trouble connecting to network shares running on Samba (Ubuntu 17.10). Entries in event logs indicate that the cause seems to be that Windows 10 1709 disabled guest access.

Originally, the share itself was protected but guests can browse what shares are available by connecting to \\samba.company.com. I added restrict anonymous = 2 to smb.conf and now Windows Explorer prompts for sign in when accessing \\samba.company.com. However, those Windows 10 1709 PCs are still having trouble connecting to the Samba shares.

Most of the articles I found talk about enabling guest access on Windows 10. Is it possible to disable guest access on Samba instead?

Best Answer

For security reasons Microsoft has disabled the SMB 2 guest access. You are right that you can change the Windows settings to allow the guest access to the samba share.

https://tech.nicolonsky.ch/windows-10-1709-cannot-access-smb2-share-guest-access/

https://support.microsoft.com/de-ch/help/4046019/guest-access-smb2-disabled-by-default-in-windows-10-server-2016

You can change GPO settings to allow this. However, you can force use SMB 3.0 on samba site (will work if all your clients support SMB 3 protocol) as an example:

client min protocol = SMB3
client max protocol = SMB3

Related Solutions

Samba – Hiding samba share from browse list for unauthorised users

To hide the full share, you can use the following option:

[global]
access based share enum = yes

To hide files/folders inside a share to users who do not have read permission on those files/folders, you can use:

[share]
...
hide unreadable = yes

Ubuntu – Can Samba “security = user” be used for guest share without Windows login prompt

From http://blog.realcomputerguy.com/2010/12/samba-and-guest-shares-with-security.html?spref=tw

In a nutshell you need:

A username map file.
A valid 'nix "guest" user mapped to the Windows guest account ("nobody" in most distros).
Proper smb.conf configuration.

In this example our username map file is /etc/samba/smbusers. It maps a 'nix user to a Windows user.

In /etc/samba/smbusers (many distros include this file, but with the default commented out):

nobody = guest

In /etc/samba/smb.conf:

[global]
   ...
   security = user
   Map to guest = Bad User
   username map = /etc/samba/smbusers
   ...
-- no 'valid users =' line --

[theshare]
   ...
   guest ok = yes
-- no 'valid users =' line --

Best Answer

Related Solutions

Samba – Hiding samba share from browse list for unauthorised users

Ubuntu – Can Samba “security = user” be used for guest share without Windows login prompt

Related Topic