I’ve just set up a new Ubuntu 18.10 server with a single SMB share which I’d like to access from Windows. But whenever I try to open the paths
\\servername\sharename in Windows, I get this error message:
You can't access this shared folder because your organization's security policies block unauthenticated guest access. These policies help protect your PC from unsafe or malicious devices on the network.
This is documented by Microsoft at Guest access in SMB2 disabled by default in Windows 10, Windows Server 2016 version 1709, and Windows Server 2019. If I use the Enable insecure guest logons group policy option, as suggested in the documentation, everything works fine. I can browse
\\servername without entering any credentials, and if I try to access
\\servername\sharename, I’m asked for a username and password. My Samba credentials work as expected.
But I don’t want to enable anything insecure! I’ve tried to disable all the default shares that are guest-accessible, and I’m happy to give up the ability to be able to browse
\\servername (although it would be nice to have). I don’t need to support any legacy clients; I just want to access the share from one Windows 10 machine with a username and password.
Noting that the error message refers to SMB2, I tried adding the line
server min protocol = SMB3 to
/etc/samba/smb.conf in the
[global] section, but this didn’t change anything.
How can I configure Samba so that Windows 10 will prompt the user for credentials, rather than attempting to use an insecure guest logon?