Win 2019 Server - SMB Session Authentication Failure - Event ID 551

Question

SMB Session Authentication Failure
Client Name: \<ip>
Client Address: <ip>:<port>
User Name:
Session ID: <sid>
Status: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xC000006D)
SPN: session setup failed before the SPN could be queried
SPN Validation Policy: SPN optional / no validation

Trying to map drive (\ip\e$) of two Windows 2019 servers to each other.
Both not in domain.
Credentials are correct, working in login to servers.
SMB1 is disabled on both.
Another Windows 2019 server (third) is working fine (drive mapped) from these two.

--Added Later--
On the server which starts this connection , Event 31010 is recorded.
The SMB client failed to connect to the share.
Error: {Access Denied}
A process has requested access to an object, but has not been granted those access rights.

The user provided for connection is having admin rights on target servers.

--Another Addition--
If I am sharing a folder , then its accessible as share name (\ip\share) but not with drive name \ip\e$ .
In the server which is working ok, I am able to access with \ip\e$ or any other drive , which is the main requirement.

Answer 1

Hi @Vipul Sharma ,

Here's a similar issue in another thread, did you have a look at it?
https://learn.microsoft.com/en-us/answers/questions/77868/smb1-compatible-device-will-not-connect-to-server.html

----------

If the reply was helpful please don't forget to upvote and/or accept as answer, thank you!

Best regards,
Leon

Answer 2

Hi,

Please check the NTLM settings on your windows server 2019, as picture below:

Make sure Network security: Restrict NTLM: Incoming NTLM traffic is not set to Deny all.

Best Regards,
Candy

--------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 3

Hi ,

In your case, we need to trace SMB traffic to find some clues. However, analysis of network traffic is beyond our forum support level and due to forum security policy, we have no such channel to collect user log information. So we recommend you open a case with MS Professional tech support service, they will help you open a phone or email case to Microsoft, so that you would get a technical support on a one-to-one basis while ensuring private information.

Here is the link:

https://support.microsoft.com/en-us/gp/customer-service-phone-numbers

Best Regards,
Candy

--------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 4

Type in the following command on the target machine:
REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f
Restart Windows.