Connecting a Windows 10 or 11 PC to a Linux Samba share that worked fine last year can suddenly fail with “Windows cannot access \\hostname” or “System error 1272.” Microsoft has been progressively tightening guest-access defaults, with the biggest change landing in Windows 11 24H2. This DevAnswers guide walks through the secure fix first (creating an authenticated Samba user) and then three quick unblocks if you cannot change the share itself.
Why Windows blocks Samba guest shares (and what changed in 24H2)
The error you are seeing comes from Windows refusing to authenticate as “guest” when the SMB server does not require a password. Microsoft first started disabling insecure guest logons by default with Windows 10 version 1709 (Fall Creators Update), but only for Enterprise, Education, and Pro for Workstations editions. Pro standard and Home stayed permissive for years.
Windows 11 24H2, released in late 2024, extended that default-disable to every edition, including Home. 24H2 also turned on SMB Signing as a default requirement, so even if you re-enable insecure guest, the connection can still fail unless you also relax the signature requirement. Microsoft’s reasoning is that an attacker on the network can spoof a legitimate file server and trick a user into connecting to a malicious share, and guest auth has no signing or encryption to defend against that.
The secure fix first: create a real Samba user
Microsoft’s actual recommendation is straightforward: do not allow insecure guest at all. If you control the Samba server, the cleanest fix is to give the share a real user and connect with a password. This survives every future Windows hardening pass and works on any client.
Connect to the Linux server over SSH and create a system user dedicated to file sharing. The exact command depends on your distro family:
sudo adduser --disabled-password --gecos "" devans
sudo smbpasswd -a devanssudo useradd -M -s /sbin/nologin devans
sudo smbpasswd -a devansBoth recipes create a Linux user called devans who cannot log in interactively (no password on Debian, nologin shell on RHEL). The second command adds that user to Samba’s password database and prompts for a Samba-only password. This separation matters: the SMB password is independent of any Linux login.
In your share definition in /etc/samba/smb.conf, set guest ok = no and either valid users = devans or grant access via group membership. Reload Samba (the service name varies by distro):
# Debian / Ubuntu: smbd
sudo systemctl reload smbd
# RHEL / Fedora / openSUSE / Arch: smb
sudo systemctl reload smb
# If you are not sure, list the running unit:
systemctl list-units '*smb*' '*samba*'systemctl, which covers all mainstream Linux distributions today. If you run a non-systemd distro (Alpine with OpenRC, Void with runit, Gentoo with OpenRC), use your distro’s service tool instead, for example rc-service samba reload on Alpine. From Windows, open \\hostname in File Explorer and Windows will prompt for credentials. Enter devans and the Samba password you set. Tick “Remember my credentials” if you want it saved to the Credential Manager. The rest of this guide covers the unblock-now path for shares you cannot reconfigure.
Method 1: Group Policy Editor (Windows Pro and Enterprise)
If you cannot change the share and need the unblock now, Group Policy is the cleanest setting on Pro and Enterprise editions. Skip to Method 2 if you are on Home, which does not include the Group Policy Editor.
- Press Windows Key + R to open the Run dialog.
- Type
gpedit.mscand press Enter. - Navigate to Computer Configuration > Administrative Templates > Network > Lanman Workstation.
- Double-click Enable insecure guest logons in the right pane and set it to Enabled.
- Click Apply and OK.
The change takes effect immediately on most builds. If the share still fails, run gpupdate /force in an elevated Command Prompt to refresh policy.
Method 2: Registry Editor (all Windows editions)
If you are on Windows Home or you prefer to manage this without Group Policy, the same setting lives in the registry. The first value enables insecure guest, the second relaxes the 24H2 signing requirement.
LanmanWorkstation branch (File > Export) before changing values so you have a one-click rollback. - Press Windows Key + R, type
regedit, and press Enter. - Paste this path into the address bar at the top:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters - Right-click in the right pane, choose New > DWORD (32-bit) Value, and name it
AllowInsecureGuestAuth. Set its value to1. - On Windows 11 24H2 or later, also create a DWORD called
RequireSecuritySignaturewith a value of0. Existing installations may already have this value set to1; change it to0instead of creating a new one. - Close the Registry Editor. The change takes effect on the next SMB connection attempt.
If your machine is managed by Group Policy from a domain controller, the equivalent values land at HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation instead. Editing the Services path on a Group Policy managed machine works for the next reboot, but the policy refresh will overwrite it. Edit the Group Policy on the domain controller in that case.
Method 3: Command-Line shortcut
If you prefer to script the registry change, run these two commands from an elevated Command Prompt or PowerShell. The first sets the guest-auth flag; the second sets the 24H2 signing flag. Skip the second line on Windows 10 and pre-24H2 Windows 11 if you want to leave signing alone.
reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v AllowInsecureGuestAuth /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v RequireSecuritySignature /t REG_DWORD /d 0 /fEach command should print “The operation completed successfully.” Open File Explorer and try \\hostname again. No restart is required.
Fix the network profile: Public to Private
Even with insecure guest enabled and signing relaxed, Windows treats SMB browsing differently on Public networks. Network Discovery and most file-sharing features only work when the active network profile is Private. If your share fails with “Network path not found” or “We can’t sign you in with this credential because your domain isn’t available,” check the profile.
- Open Settings > Network & Internet.
- Click your active connection at the top (Ethernet or Wi-Fi).
- Under Network profile type, select Private.
Windows 10 has the same control under Settings, and the legacy path through Control Panel > Network and Sharing Center > Change advanced sharing settings still works on both versions. There you can also confirm that Turn on network discovery is active for your Private profile.
Still broken? Common follow-on issues
If the methods above did not unblock the share, work through this list in order:
- Stale Windows updates: open Windows Update and install any pending cumulative updates. Several SMB negotiation regressions have been fixed in post-release patches.
- Old advice you may see: re-enable SMB 1.0/CIFS File Sharing Support in Windows Features. Do not. The next section explains why.
- Samba server’s
server max protocolis too low: on the Linux server runtestparm -s | grep -Ei 'server (min|max) protocol'and make sureserver max protocolis not set toNT1(SMB1). Preferserver min protocol = SMB2_02or newer; leaveserver max protocolat its default unless you know why you are changing it. - Linux firewall blocks SMB: open
445/tcpon the server. Withufw:sudo ufw allow 445/tcp. Withfirewalldon RHEL/Fedora:sudo firewall-cmd --add-service=samba --permanent && sudo firewall-cmd --reload. - Share has
guest ok = no: re-check the[share]section in/etc/samba/smb.conf. If you are using the secure fix above, this is correct; if you wanted a guest share, setguest ok = yes. - Hostname will not resolve: try the share’s IP address directly (
\\192.168.1.50). If that works, the issue is name resolution. Edit the Windows hosts file to map the hostname to the IP, or run a discovery daemon on the Linux server so the host advertises itself (our wsdd guide covers this).
Don’t fall back to SMBv1
Forum threads going back nearly a decade tell readers to enable SMB 1.0/CIFS File Sharing Support in Windows Features. Ignore that advice. Microsoft deprecated SMBv1 in 2014 and removed it from the default install starting with Windows 10 version 1709 for Enterprise, Education, and Pro for Workstations. By Windows 10 version 1809 it was no longer installed by default in Pro either.
The reason matters. The 2017 WannaCry and NotPetya ransomware outbreaks used SMBv1 as their primary worm propagation vector through the EternalBlue exploit (CVE-2017-0145, addressed in Microsoft Security Bulletin MS17-010). Re-enabling SMBv1 today reopens the same attack surface that cost hospitals and shipping companies hundreds of millions in 2017.
Modern Windows includes a one-time 15-day auto-uninstall: if SMBv1 is enabled but unused for 15 days, Windows quietly removes it. The methods earlier in this guide keep the connection on signing-capable SMBv2 or SMBv3 while permitting passwordless guest access if that is what the share requires.
Conclusion
Pick the path that matches your situation: the secure fix if you control the Samba server, Group Policy on Pro and Enterprise, or the Registry method on Home. Add the RequireSecuritySignature tweak if you are on Windows 11 24H2 or later. If discovery is also broken (the host does not appear in Network at all), see our guide to advertising Linux hosts to Windows with wsdd. If you are setting up the Samba side from scratch, our Samba install guide walks through the full server setup.
Great! Thak worked for me, Thank you!
I had to do both steps, registry changes too
Now I have to figure out why I can only access the folders in the main disk and not the others…
Solution works. However, it works with RequireSecuritySignature set to 0 instead of 1.
I spent a late evening pulling my hair out trying to resolve this issue. I tried everything posted in this thread and many other suggestions without success. I was almost ready to wave the white flag when I figured it out myself. Hopefully this will help some of you who have been unsuccessful so far:
Go to the Windows Control Panel and under Programs select “Turn Windows Features On or Off”. Scroll down to “SMB 1.0/CIFS File Sharing Support” and place a checkmark beside this and click “OK”. It will then Search for the required files and apply the changes. Select “Restart Now” when prompted.
Click the START menu and type “regedit” and select “Run as Administrator”.
Go to the following location:
ComputerHKEY_LOCAL_MACHINESOFTWAREMicrosoftPolicyManagerdefaultLanmanWorkstationEnableInsecureGuestLogons
Double click on “value” and change the value data from 0 to 1 and select “OK”.
You may want to reboot at this point but I was able to access the SAMBA share immediately after changing this value. It is part 2 of my instructions above that seemed to be the special sauce. I had found many suggestions to turn on the SMB 1.0 feature, as well as suggestions to make changes to the Local Group Policy or using regedit to modify parts of the registry, but not the specific registry address referenced above. This is what worked for me and I hope that it makes life easier for someone else.
As an added note, my computers were running Winsows 10 Pro version 2004 and 20H2.
Thanks for the comment. However, my article was written to prevent people from re-enabling the unsecure SMB 1 protocol. I would never advise that users enable SMB 1 in Windows 10 as it opens up the OS to security holes. Microsoft disabled it through Windows Update for a very good reason.
I would point people to this article if you are having issues viewing Samba shares from Windows 10. https://devanswers.net/discover-ubuntu-machines-samba-shares-windows-10-network/
This guide has been updated as per recomedations by commenter MR0002 below.
It appears that gpedit.msc does not update all settings in regedit as required. Also, Windows 10 Home edition does not have gpedit.msc at all, so all updates must be done through regedit.
Hope this helps.
Worked flawlessly. Thank you!
One thing I would add. If you are having this issue and you are using Windows 10 Home, gpedit.msc is disabled by default and you need to use a bash script to enable it. Otherwise windows doesn’t recognize gpedit. Link to instructions below.
https://www.itechtics.com/enable-gpedit-windows-10-home/
Thanks for the link 🙂
Nope not working
wow that worked, thank you so much!
thanks this was a big big help if you have legacy old linux hardware on your network; i became a computer god to these people now:)
Worked.
Thank you
For me, the solution was to update the registry and set both AllowInsecureGuestAuth to 1 and RequireSecuritySignature to 0, all the threads that came up in my searches (and I tried for hours) mentioned setting AllowInsecureGuestAuth to 1 or changing the Enable insecure guest logons in the group policy as this article details, but none of this worked for me until I also set RequireSecuritySignature to 0. I’m running the latest May 2020 Win10 Update build (version 2004), as soon as I set this additional registry setting I was able to connect to my share without issue, no restart needed. I was connecting to a WD MyCloud Home public drive from my work laptop while at home, and the MyCloud Home doesn’t allow you to set creds for the SMB Public drive – below are the registry settings that FINALLY resolved the issue.
One other note, there were additional firewall and network sharing / discovery controls on my machine, within Network and Sharing I had to change my home WiFi network to be marked as a Private Network instead of a Public Network – the additional restrictions were specific to Public networks, changing to Private resolved it.
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesLanmanWorkstationParameters]
“AllowInsecureGuestAuth”=dword:00000001
“RequireSecuritySignature”=dword:00000000
saved my time and nerves …..thanks a lot for this solution .
Thank you!
Tried everything, but I guess this was the final step to get it working….
Excellent!
Excellent work!
This is the solution that worked for me! Thanks for posting. I had Windows10 Home versions that were not getting error, but main PC is Windows10 Pro and threw an error every time. Changing “AllowInsecureGuestAuth” to “1” fixed it. Interestingly Home does not have this Registry value avoiding the problem.
Getting done by editing the registry by your discussion. Thanks a lot.
Thank you. Thank you. Thank you. you made my day!
Changing the AllowInsecureGuestAuth worked for me. Thank you so much. I was tearing my hair out.
magic! this one really works!
Thank you! this helped me in getting the answer for my system. I did a search of RequireSecuritySignature and chamged all the instances to 0. I had to reconnect the network share because the browse gadget did not found it, then it was routine, login, password and connected! Thanks!
Thanks a lot guy, this works!
you are awesome!!!!
not working
Thank christ a super easy solution!
you’re magic…. success
Why does Windows more and more require regedit? It takes me ages to find keys and values described in such tweaks and 95% of the time, I neeed to create a non-sense DWORD. This is time consuming and error prone. Why aren’t there GUI tools to configure these options? I just cannot go on. This is over complicated and I’m about to bang my head over a wall. I just want to transfer data from my old computer to a new, made the stupid mistake of choosing a case that can just accept two drives and thus cannot add my old PC’s drive temporarily even though that looks to be the only solution. External hard drives are super super super slow, taking more than twenty minutes simply to copy a few gigabytes of data. I’m just done, I cannot continue like this (and yes this is supposed to be a USB3 external drive the ones I tried).
OMG!
I have tried so many things off the internet! This one worked straight off the bat!
You are a magician!
Thank you so much!
Thank you!
Did the trick beautifully, thanks!
😊👍
did not work for me
for me neither.
Same
It fixed access from this Win10 computer to others, but not my other computers to this Win10 computer. Half fixed.