Windows 10: Windows 10 can see server 2012 shares but refuses access

Hi Everyone -


I've spent several frustrating hours on this problem, and hope by posting to save someone else the grief.


Problem: On Windows 10, trying to access some server 2012 shares gives a "you don't have permission...." error. Of course I have triple checked the permissions to the share. The firewall made no difference after I turned it off. The shares are all visible to the W10 machine, just some shares give a permission error, despite correct user permissions.


I admit I intuited the solution by borrowing an idea from another thread, but the thread was not directly related. Just for the heck of it I tried the following, which makes no sense, but works:


I edited the hosts file and added an entry for the server. Inexplicably that solved the problem. I was then able to map the drive to the needed share. It already knows where the server is because it can map some folders, not others, and all the shares display properly. Makes no sense, right? Can you say Windows 10? A wild guess is buggy DNS client software.


Chris

:)

 

Windows 10 File Shares not accessible from Server 2012

Configuration

Servers:

• Location 1
  • SCCM-Central1-loc1
    • 2012 R2
    • 10.70.4.228/24
• Location 2
  • SCCM-DP1-loc2
    • Windows 10 Build 1803
    • 172.22.65.4/24
    • No Symantec Endpoint Protection
  • FILESERVER-FS1-loc2
    • 2012 R2
    • 172.22.65.231/24
• Location 3
  • SCCM-DP2-loc3
    • Windows 10 Build 1803
    • 172.22.186.4/24
    • Symantec Endpoint Protection
• Location 4
  • SCCM-DP3-loc4 (Tega)
    • Windows 10 Build 1803
    • 172.22.207.4
    • Symantec Endpoint Protection
    • Citrix Receiver
• Location 5
  • SCCM-DP4-loc5 (PTZA)
    • Windows 10 Build 1803
    • 172.22.185.4
    • Symantec Endpoint Protection
    • Citrix Receiver

• We need to be able to attach to the f$ share on each of the “SCCM-DPx-LOCx” servers from the “SCCM-Central1-loc1”.
  
  • Issue Attempting to connect to
    • \\172.22.65.4\f$
    • \\ SCCM-DP1-loc2\f$
    • \\ SCCM-DP1-loc2.DOMAIN.com\f$
    • \\10.120.186.4\f$
    • \\ SCCM-DP2-loc3\f$
    • \\ SCCM-DP2-loc3. DOMAIN.com\f$
      • Fails from SCCM-Central1-loc1 or any Windows 2012 R2 server outside of the 172.22.65.0/24 subnet.
        
        • Error:
          
          Windows cannot access \\ SCCM-DP1-loc2\f$

Check the spelling of the name. Otherwise, there might be a problem with your network. To try to identify and resolve network problems, click Diagnose.

See Details shows

Error Code: 0x80004005

Unspecified error

• Works from any Windows 10 workstation even across the VPN. Also works from a Server 2012 R2 server in the 172.22.65.0/24 subnet

• Works Attempting to connect to
  • \\172.22.65.231\f$
  • \\ FILESERVER-FS1-loc2\f$
  • \\ FILESERVER-FS1-loc2.DOMAIN.com\f$
  • \\ 172.22.207.4\f$
  • \\ SCCM-DP3-loc4\f$
  • \\ SCCM-DP3-loc4. DOMAIN.com\f$
  • \\ 172.22.185.4\f$
  • \\ SCCM-DP3-loc5\f$
  • \\ SCCM-DP3-loc5. DOMAIN.com\f$
    • Works from all locations and all machines

• Notes:
  • Connecting from any Windows 10 machine to the failing systems works every time (see above).
  • Connecting to a Windows 2012 R2 server in the same subnet as one of the failing systems works every time.
    
  • Auditing of ports from any location to the systems in this subnet renders the same result:

Test-NetConnection -port 138 -ComputerName "FILESERVER-FS1-loc2" -InformationLevel "Detailed"

WARNING: TCP connect to FILESERVER-FS1-loc2:138 failed

ComputerName : FILESERVER-FS1-loc2

RemoteAddress : 172.22.65.231

RemotePort : 138

AllNameResolutionResults : 172.22.65.231

MatchingIPsecRules :

NetworkIsolationContext : Private Network

IsAdmin : False

InterfaceAlias : Ethernet

SourceAddress : 10.70.4.228

NetRoute (NextHop) : 10.70.4.1

PingSucceeded : True

PingReplyDetails (RTT) : 39 ms

TcpTestSucceeded : False

Test-NetConnection -port 137 -ComputerName "FILESERVER-FS1-loc2" -InformationLevel "Detailed"

WARNING: TCP connect to FILESERVER-FS1-loc2:137 failed

ComputerName : FILESERVER-FS1-loc2

RemoteAddress : 172.22.65.231

RemotePort : 137

AllNameResolutionResults : 172.22.65.231

MatchingIPsecRules :

NetworkIsolationContext : Private Network

IsAdmin : False

InterfaceAlias : Ethernet

SourceAddress : 10.70.4.228

NetRoute (NextHop) : 10.70.4.1

PingSucceeded : True

PingReplyDetails (RTT) : 39 ms

TcpTestSucceeded : False

Test-NetConnection -port 139 -ComputerName "FILESERVER-FS1-loc2" -InformationLevel "Detailed"

ComputerName : FILESERVER-FS1-loc2

RemoteAddress : 172.22.65.231

RemotePort : 139

AllNameResolutionResults : 172.22.65.231

MatchingIPsecRules :

NetworkIsolationContext : Private Network

IsAdmin : False

InterfaceAlias : Ethernet

SourceAddress : 10.70.4.228

NetRoute (NextHop) : 10.70.4.1

PingSucceeded : True

PingReplyDetails (RTT) : 39 ms

TcpTestSucceeded : True

Test-NetConnection -port 445 -ComputerName "FILESERVER-FS1-loc2" -InformationLevel "Detailed"

ComputerName : FILESERVER-FS1-loc2

RemoteAddress : 172.22.65.231

RemotePort : 445

AllNameResolutionResults : 172.22.65.231

MatchingIPsecRules :

NetworkIsolationContext : Private Network

IsAdmin : False

InterfaceAlias : Ethernet

SourceAddress : 10.70.4.228

NetRoute (NextHop) : 10.70.4.1

PingSucceeded : True

PingReplyDetails (RTT) : 39 ms

TcpTestSucceeded : True

• Attempted Fixes
  • NSLOOKUP does find the systems
  • Creating a non-Admin share was no different
  • Turning off IPv6 was no help
  • Turning on SMB file sharing did not help
  • Checked and the OS firewall for Domain, Private, Guest or Public, all are off
  • Removing the SCCM-DP1-loc2 from the domain then will respond with a prompting for username and password, but still does not allow login and eventually fails with the same error.
    
    • Error:
      
      Windows cannot access \\ SCCM-DP1-loc2\f$

Check the spelling of the name. Otherwise, there might be a problem with your network. To try to identify and resolve network problems, click Diagnose.

See Details shows

Error Code: 0x80004005

Unspecified error

• Disabled SMB2/3 and this still fails
• Verified that SMB1 is present

Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

FeatureName : SMB1Protocol

DisplayName : SMB 1.0/CIFS File Sharing Support

Description : Support for the SMB 1.0/CIFS file sharing protocol, and the Computer Browser protocol.

RestartRequired : Possible

State : Enabled

 

Server 2012

IF you want to try seizing the FSMO roles to see if it will help, here is a quick guide (this should be done on the DC you want to keep):

https://blogs.technet.microsoft.com...ation-master-roles-in-windows-server-2012-r2/

Knowing that this is a DC now I'm really convinced that something is wrong with the AD account for this particular server. It's possible that the promotion to a DC didn't work correctly leaving you with a sort of broken DC.

A reboot is always worth a shot; has that been tried Ahhzz? If it has, then the next step would be to demote this DC and rejoin it to the domain. Once rejoined you can run DCPromo again. Microsoft best practice is to have at least 2 DCs for redundancy.

 

Server 2012

Also don't forget to reset the account in AD Users and Computers to avoid any SID issues.