Windows 10: SMB1 disabled, SMB2 enabled; Can no longer access network shares

Hey All,

After the recent Wanncry attacks I disabled SMB1 protocol as per the cautionary suggestions from Msft et al. Now I can no longer access my network shares via File Explorer. I am still able to access the network device using IP address via browser. However, the unifying and familiar Explorer remains stubbornly broken. When I turn SMB1 back on everything works ok. Any ideas how to fix File Explorer access while remaining somewhat protected. Mucho thanks in advance.

M.B.

:)

 

SMB1 disabled; No longer have access to mapped network shares via File Explorer

As per Microsoft suggestion I disabled the SMB1 protocol to stave off Wcry type attacks. At the same time I made sure SMB2 protocol was enabled. Now, i can no longer access mapped network shares using File Explorer. To verify the situation I turned SMB1
back on and was again able to use File Explorer successfully. The network drive is operating properly; I checked using the browser admin features over IP. At present SMB1 is still off and SMB2 is on.

What must I do short of re-enabling SMB1 to allow File Explorer to access the network drive?

M.B.

Config; Windows 10 Pro - latest, Synology DSM - latest

 

Windows 10 and 16 do NOT prompt on network share.

I've spent weeks reading various solutions which work to no avail. Mine seems to be a tad unique so I'm trying to understand what's going on and how to fix it.

In short...

I am testing access to a network share that's running on an EMC Centera. I don't think that's relevant but wanted to make sure it was known.

I have a Windows 7, Windows 10, Windows 12 and Windows 16. The Windows 7 & 12 can access the shares using Start>Run> \\hostname\path. I get prompted for user credentials no problem and can properly access the share. On Windows 10 & 16 if I go the same
route, I get The specified network name is no longer available. I'm not prompted for credentials.

Another interesting part is if I open cmd in Windows 10 & 16 and execute net use \\hostname\path I'm prompted for credentials and have access. And if I Map Network Drive and enter \\hostname\path I get prompted for credentials and have access. If I then
execute net use * /delete to remove all paths, and try to access the shares via Start> Run or Windows Explorer I receive the original error message and am no longer prompted for credentials.

I can even net use to \\hostname\IPC$ and provide credentials, then I have access to all shares, which makes sense because the current/active credentials are stored.

I've run Wireshark to compare the successful/unsuccessful and one thing I've noticed is that Windows 7 & 12 negotiate SMB2, Sessions Setup is NTLMSSP_NEGOTIATE. It eventually errors out while trying to use the current user account but what's even more interesting
is it re-attempts the session 9 times, then it has an SMB2 Tree Disconnect Request & Session Logoff Request, then it prompts for user credentials. I then run the same test on Windows 10 & 16 (the failing ones) and they negotiate SMB2, Sessions Setup is NTLMSSP_NEGOTIATE,
it also eventually errors out BUT the host sends SMB2 Negotiate Protocol Requests many more times but never gets an SMB2 Negotiate Protocol Response. This eventually errors out thus providing the "The specified network name is no longer available".

Things I have done/tested:

Disabled IPv6

Reinstalled Client for Microsoft Networks

Turned Off Network Discovery

Turned On Network Discovery

Checked Computer Management Local Policies > Security and compared/matched to the Windows 7/12 machines.

Disabled SMB1

Enabled SMB1

Disabled SMB2/3

Enabled SMB2/3

Checked for Cached Credentials in Users>Manage Credentials - it's always empty

I apologize for the length but I wanted to be thorough. Any help would be greatly appreciated.

 

If you're system is up to date, there's no need to be concerned about Wannacry - as such there's no problem using SMB1 (despite all the comments about SMB1)

I had the same problem - no shares visible on File Explorer - researched the issues related to disabling SMB1 - and quite frankly, it's only SMB1 on XP machines that will be (would have been before MS released a patch for XP) susceptible to a Wannacry attach. I suggest you reinstate SMB1 and enjoy accessing your network shares as before

R

 

I've heard the same from several sources and have reverted to smb1. Even so, I wonder why smb2/smb3 isn't enough to provide access to the networked resources. Thanks for the reply.

m.b.

 

Been through this and enabled SMB1 again.
Why it doesn't work? My findings were in this thread WannaCry - Page 2 - Windows 10 Forums
When you disable SMB1 it uninstalls stuff needed by Workstation service, as said the exploit was patched back in March.