{"id":585,"date":"2025-07-13T17:30:55","date_gmt":"2025-07-13T15:30:55","guid":{"rendered":"https:\/\/it4home.dk\/?p=585"},"modified":"2025-07-13T18:02:23","modified_gmt":"2025-07-13T16:02:23","slug":"windows-10-11-and-smb-guest-access","status":"publish","type":"post","link":"https:\/\/it4home.dk\/index.php\/2025\/07\/13\/windows-10-11-and-smb-guest-access\/","title":{"rendered":"Windows 10\/11 and SMB guest access"},"content":{"rendered":"
<\/a>\"image_print\"<\/a><\/div>\n

Windows SMB change and how to lock down your Raspberry Pi with SMB3 encryption:<\/p>\n\n\n\n

Windows 10\/11 and SMB guest access<\/strong>
Starting with Windows 10 version 1709 (Fall Creators Update) and all Windows 11 releases, Microsoft disabled unauthenticated \u201cguest\u201d access over SMB2 and SMB3 by default to block insecure, unencrypted logons (MKS Technology Inc<\/a>)
URL: https:\/\/support.microsoft.com\/en-us\/help\/4046019\/guest-access-in-smb2-disabled-by-default-in-windows-10-and-windows-server-2016<\/a><\/p>\n\n\n\n

Configuring your Raspberry Pi for SMB3-only, encrypted shares<\/strong>
Samba \u2265 4.2 (your 4.17.12 build included) fully supports SMB 3.x and on-the-wire encryption (Server Fault<\/a>)
URL: https:\/\/serverfault.com\/questions\/913504\/samba-smb-encryption-how-safe-is-it<\/a><\/p>\n\n\n\n

Replace your \/etc\/samba\/smb.conf<\/code> with this:<\/p>\n\n\n\n

[global]\n   workgroup = WORKGROUP\n   netbios name = raspberrypi\n   server string = Raspberry Pi SMB3 Encrypted\n   security = user\n   map to guest = never\n   usershare allow guests = no\n   guest account = nobody\n\n   server min protocol = SMB3\n   server max protocol = SMB3\n   client min protocol = SMB3\n   client max protocol = SMB3\n   smb encrypt = required\n\n[data]\n   comment = Encrypted SMB3 Share\n   path = \/data\n   browseable = yes\n   writable = yes\n   valid users = pi\n   create mask = 0775\n   directory mask = 0775\n<\/code><\/pre>\n\n\n\n
    \n
  1. Prepare the share directory and permissions: sudo mkdir -p \/data sudo chown pi:pi \/data sudo chmod 775 \/data<\/code><\/li>\n\n\n\n
  2. Add pi<\/code> as an SMB user: sudo smbpasswd -a pi<\/code><\/li>\n\n\n\n
  3. Apply changes: sudo systemctl restart smbd<\/code><\/li>\n<\/ol>\n\n\n\n
    This forces only SMB 3.x<\/strong> connections with required encryption<\/strong>, and only user pi<\/code> can connect (Server Fault<\/a>)
    URL:     https:\/\/serverfault.com\/questions\/895570\/how-to-configure-samba-to-work-with-windows-10-1709<\/a><\/p>\n\n\n\n
    Verifying your setup<\/strong><\/p>\n\n\n\n