Accessing a third-party NAS with SMB in Windows 11 24H2 may fail

[Guest Ned Pyle]

Heya folks, Ned here again. With the publication of Windows 11 24H2 Release Preview, customers are trying out the new OS prior to general availability. If you were in the Windows Insider Canary or Dev release program for the past few years, nothing I'm about to share is new. But if you weren't and you're now having issues mapping a drive to your third-party network attached storage (NAS) devices using SMB, this article is for you.

 

 

 

[HEADING=1]What changed[/HEADING]

 

In Windows 11 24H2, we've made two major security changes that can affect mapping drives to third-party consumer NAS or routers with USB storage:

 

 

 

1. By default, SMB signing is required on all connections. This increases your security by preventing tampering on the network and stops relay attacks that send your credentials to malicious servers.
   
2. Guest fallback is disabled on Windows 11 Pro edition. This increases your security when connecting to untrustworthy devices. Guest allows you to connect to an SMB server with no username or password. While convenient for the maker of your NAS, it means that your device can be tricked into connecting to a malicious server without prompting for credentials, then given ransomware or having your data stolen.
   

 

SMB signing has been available in Windows for 30 years but, for the first time, is now required by default on all connections. Guest has been disabled in Windows for 25 years and SMB guest fallback disabled since Windows 10 in Enterprise, Education, and Pro for Workstation editions. Both changes will make billions of devices more secure. They've been in Windows Insider Dev and Canary builds for a year.

 

 

 

[HEADING=1]What happens with a third-party NAS[/HEADING]

 

There's one unavoidable consequence, though: we don't know when someone intended to be unsafe.

 

 

 

• We don't know the difference between a NAS that doesn't have SMB signing enabled and an evil server that doesn't want SMB signing enabled.
  
• We also don't know the difference between a consumer NAS - where the manufacturer used guest access to simplify connecting to their storage at the expense of security - and an evil server that wants you to connect without any security prompts in order to steal all of your files and or deliver malware. Furthermore, SMB signing cannot be used with guest credentials. So even if you have guest fallback enabled, SMB signing will prevent it from working.
  

 

If you have installed Windows 11 24H2 Release Preview and see one of these errors trying to connect to your third-party device afterwards that was working fine previously, you're in the right place.

 

 

 

If signing isn't supported by your third-party device, you may get error:

 

• 0xc000a000
  
• -1073700864
  
• STATUS_INVALID_SIGNATURE
  
• The cryptographic signature is invalid
  

 

If guest access is required by your third party, you may get error:

 

• You can't access this shared folder because your organization's security policies block unauthenticated guest access. These policies help protect your PC from unsafe or malicious devices on the network
  
• 0x80070035
  
• 0x800704f8
  
• The network path was not found
  
• System error 3227320323 has occurred
  

 

 

 

[HEADING=1]How to solve the issues[/HEADING]

 

To solve these issues, we recommend you do the following in this order. It's ordered from the safest to the least safe approach, and our goal is for your data to be protected, not to help third parties sell you unsafe products.

 

 

 

1. Enable SMB signing in your third-party NAS. Your vendor will have steps to do this online if it's possible in the device's management software.
   
2. Disable guest access in your third-party NAS. Your vendor will have steps to do this online if it's possible in the device's management software.
   
3. Enable a username and password in your third-party NAS. Your vendor will have steps to do this online if it's possible in the device's management software.
   
4. Upgrade your NAS if you cannot enable signing, cannot disable guest, or cannot use a username and password. The NAS will usually have an upgrade option in its management software, possibly labeled as "firmware update."
   
5. Replace your NAS if you cannot upgrade your NAS software to support signing and credentials (you will need to use steps 6 and later to copy your data off of it to your new NAS first)
   

 

Now we're into the less recommended steps, as they will make your Windows device and your data much less safe. They will, however, let you access this unsafe NAS.

 

 

6. Disable the SMB client signing requirement:

 

a. On the Start Menu search, type

gpedit

and start the

Edit Group Policy

app (i.e. Local Group Policy Editor).

 

b. In the console tree, select

Computer Configuration > Windows Settings > Security Settings> Local Policies > Security Options

.

 

c. Double-click

Microsoft network client: Digitally sign communications (always)

.

 

d. Select

Disabled

>

OK

.

 

 

7. Disable the guest fallback protection:

 

a. On the Start Menu search, type

gpedit

and start the

Edit Group Policy

app (i.e. Local Group Policy Editor).

 

b. In the console tree, select

Computer Configuration > Administrative Templates> Network > Lanman Workstation.

 

c. Double-click

Enable insecure guest logons

 

d. Select

Enabled

>

OK

.

 

 

[HEADING=1]Learning more & helping the community[/HEADING]

 

If you have a third-party NAS device that doesn't support SMB signing, we want to hear about it. Please email wontsignsmb@microsoft.com with the make and model of your NAS device so we can share with the world and perhaps get the vendor to fix it with an update.

 

 

 

For more details on these technologies, what they do, and what the future holds, review blog posts:

 

 

 

• SMB signing required by default in Windows Insider - Microsoft Community Hub
  
• SMB insecure guest auth now off by default in Windows Insider Pro editions - Microsoft Community Hub
  
• SMB Signing and Guest Authentication - Microsoft Community Hub
  
• Storage at Microsoft - Microsoft Community Hub
  

 

For the official MS Learn docs, review:

 

 

 

• Control SMB signing behavior (preview) | Microsoft Learn
  
• Guest access in SMB2 and SMB3 is disabled - Windows Server | Microsoft Learn
  
• Enable insecure guest logons in SMB2 and SMB3 for Windows client and Windows Server | Microsoft Learn
  

 

 

 

Until next time,

 

 

 

Ned Pyle

 

Continue reading...