View original (French)

SMB protocol not working

Rutra -  
 Rutra -
Hello everyone,

I’m facing a problem that I can’t seem to understand. I’m trying to connect to the hard drive of one of the PCs on a network linked to mine (SMB protocol - port 445) without success.
I type \\XXX.XXX.XXX.XXX\c$ (to access the C drive of the computer) and I end up getting an error message “Windows cannot access XXX...” Error code: 0x800004005

There’s a corporate firewall between my PC and the one I'm trying to reach, but port 445 has been authorized on it.
Moreover, every time I initiate a request, we can see the authorized traffic... However, the connection never happens.
When I connect my sending PC on the other side of the firewall, I can indeed connect, but I thought we might be using another protocol to achieve that.
I launched Wireshark on both PCs, and on the sender, I can see traffic on port 445, but on the receiver, nothing ever arrives. The interpretation of the other data provided by Wireshark is a bit beyond my skills.

I ran Netstat -a on the receiving PC, and port 445 is indeed open; I also disabled the firewall on the PC without success... All of this is starting to exceed my skills.
Both PCs are Windows 10, and I have already managed to perform the same manipulations on quite a few target PCs running Windows 7. Could it be impossible on Windows 10?

3 answers

  1.
    kaumune Posted messages 22605 Registration date   Status Contributor Last intervention   5 158
     
    Hi

    You need to allow the connection to administrative shares with this reg file 

    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]

    "LocalAccountTokenFilterPolicy"=dword:00000001
    0
    1. Rutra
       
      Hello, thank you for this lead.
      The registry didn’t exist, I created it and rebooted the PC, but unfortunately, the same problem persists. (And if that had been the issue, I wouldn’t have been able to connect on the other side of the firewall, right?)
      0
    2. brupala Posted messages 111145 Registration date   Status Member Last intervention   14 448
       
      Hi,
      It is true that in principle, you do not connect to an administrative share if you are not a domain admin.
      However,
      it's not just port 445; you also need to check that tcp port 139 is allowed as well, it can be useful, especially in a workgroup.
      0
    3. kaumune Posted messages 22605 Registration date   Status Contributor Last intervention   5 158 > Rutra
       
      You created it on which machine?

      Of course, you need to create it on the machine you want to connect to.
      0
    4. Rutra > kaumune Posted messages 22605 Registration date   Status Contributor Last intervention  
       
      Yes, that's exactly what I did; I created it on the machine I want to connect to.
      0
    5. Rutra > brupala Posted messages 111145 Registration date   Status Member Last intervention  
       
      Yes, it's a bit particular. I am the admin on the site but without real knowledge since I'm not an IT professional (there are none in the company). The firewall management is outsourced to a service provider, and they assure me that the firewall is not the source of the problem (without knowing what is actually blocking).
      Port 139 is indeed not open, but that doesn't pose a problem for the 5 Windows 7 PCs + 1 Windows XP PC that I have already managed to connect via this protocol. I was hoping it could be the same for Windows 10.
      Is it imperative to open this port? I don't even see it appearing when I launch Wireshark.
      0
  2. crapoulou Posted messages 28002 Registration date   Status Moderator, Security Contributor Last intervention   8 046
     
    Hello,

    - On the PC you want to access, does the command "net share" display the administrative share C$? (Or "Get-SmbShare" in PS)

    - Is this in a business context? Is there a domain? Is it with a domain admin account (and thus of the PC)?

    - If it's a local account (not part of the domain), try connecting to C$ by mapping a network drive (GUI or CLI: net use Z: \\XXX.XXX.XXX.XXX\c$ /user:XXX.XXX.XXX.XXX\Administrator [Enter] then enter the admin password)

    - Try disabling the Antivirus?

    - Check the software firewall to ensure SMB is enabled. Disabling the firewall can sometimes break the connections => Set-NetFirewallRule -Name "FPS-SMB-In-TCP-NoScope" -Enabled True
    Source (Be careful to enable it in "Public", "Private" or "Domain" according to the network connection configuration in Windows.
    0
    1. Rutra
       
      Hello, thank you for the help
      By using the command "net share" I can see my C$ in administrative share
      I am not very familiar with the concept of domain, but I believe there is a domain in the part where I am located.

      To summarize the situation, I will try to make a small diagram of the paths I take:

      [Office domain: contains my PC (admin of the PC but not of the domain) on DHCP] <=>
      [Firewall / +router that serves as an intermediary between the 2 networks] <=>
      [Network without domain, not connected to the internet, with target PC/ fixed IP]

      There is no antivirus on the target PC (unnecessary since it is not connected to the internet)

      On the firewall, I cannot find "File and printer sharing (SMB Inbound)." But everything that includes the term SMB is activated (and the firewall is disabled in any case)
      I will look more closely into the link you sent to try to understand.
      0
    2. brupala Posted messages 111145 Registration date   Status Member Last intervention   14 448 > Rutra
       
      Uh... no antivirus because not connected to the internet, that's going to make quite a few people jump.
      Certainly the risk is lower, but far from zero.
      0
    3. Rutra > brupala Posted messages 111145 Registration date   Status Member Last intervention  
       
      It's not a freely accessible PC ^^
      It's a PC that runs things autonomously, on a network that is not connected to the internet. Plus, everything on this network has a fixed IP... Many USB ports are disabled. It's true that there is no such thing as zero risk, but it is still very low =)
      0
    4. Rutra
       
      After checking, I successfully opened all the firewall ports, but to no avail.
      I also tried mapping the drive as a network drive with no success either (even though it works perfectly with PCs running Windows 7).
      Do you have any other ideas? I'm hesitant to try creating a virtual machine on the PC to see if it works if I use another OS... Because it seems that Windows 10 is indeed the problem.
      0
  3. phil2k Posted messages 10841 Registration date   Status Contributor Last intervention   2 339
     
    Hello
    A lead, maybe: Win10 uses SMB V2.
    Enable SMB V1 on Win10 machines

    --
    There are 3 kinds of people: those who can count and those who cannot.
    There are two categories of people: those who divide everything into two categories and the others.
    0
    1. brucine Posted messages 24865 Registration date   Status Member Last intervention   4 172
       
      Hello,

      A recap of the items to check if it helps:

      http://woshub.com/enable-remote-access-to-admin-shares-in-workgroup/
      0
      1. Rutra > brucine Posted messages 24865 Registration date   Status Member Last intervention  
         
        Hello thank you, unfortunately that doesn't seem to be enough. LocalAccountTokenFilterPolicy is already enabled on my target PC, without success...
        Do you know how to enable SMB v1 on W10?
        0
      3. Rutra > brucine Posted messages 24865 Registration date   Status Member Last intervention  
         
        Unfortunately, that doesn't work either :'(
        Thank you for the link
        0