RE: To disable SMB packet and secure channel signing enforcement on Windows Server 2003-based domain controllers

From: Murad Talukdar (talukdar_m_at_subway.com)
Date: 05/05/05

  • Next message: Laura A. Robinson: "RE: To disable SMB packet and secure channel signing enforcement on Windows Server 2003-based domain controllers" 
    Date: Thu, 05 May 2005 09:30:19 +1000
To: '?????? ??????' <morsin@eastbridge.tula.ru>

    >>1. Return back to "Enabled" secure channel ecnryption requirement. SMB
    file
    sharing has nothing to do woth it. Secure Channel is used by domain member
    computers to pass user authentication information to DCs.

    Now the thing here is; in order to allow the scanner access to the shared
    drives, I was advised to setup a 'user' so that there would not be any
    authentication issues. Then I had to allow that 'user' permissions etc on
    the folders in question. This was the only way I could find that the scanner
    could actually dump the files to the req'd share.
    I will try it and see if that allows the scan to dump the file.
    Sorry, I should have mentioned this at the beginning but was trying to keep
    it succinct. (I can already hear sucking in of breath!)

    Murad
    -----Original Message-----
    From: ?????? ?????? [mailto:morsin@eastbridge.tula.ru]
    Sent: Wednesday, May 04, 2005 10:52 PM
    To: Murad Talukdar
    Subject: Re: To disable SMB packet and secure channel signing enforcement on
    Windows Server 2003-based domain controllers

    ----- Original Message -----
    > 1. From Administrative Tools open Domain Controller Security Policy 2.
    > Smile
    > 3. Select \Security Settings\Local Policies\Security Options folder. 4. In
    > the details pane, double-click Microsoft network server: Digitally sign
    > communications (always), and then click Disabled to prevent SMB packet
    > signing from being required. 5. Click OK. 6. In the details pane,
    > double-click Domain member: Digitally encrypt or sign secure channel data
    > (always), and then click Disabled to prevent secure channel signing from
    > being required. 7. Click OK.

    1. Return back to "Enabled" secure channel ecnryption requirement. SMB file
    sharing has nothing to do woth it. Secure Channel is used by domain member
    computers to pass user authentication information to DCs.
    2. There are companion settings "Digitally sign communications (always)" and

    "Digitally sign communications (when possible)" for both servers and
    workstations. Set first to "Disabled" and second to "Enabled" and your DCs
    will communicate securely with users and insecurely with your printer.

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Laura A. Robinson: "RE: To disable SMB packet and secure channel signing enforcement on Windows Server 2003-based domain controllers"

    Relevant Pages

    • Re: Kerberos errors after swapping domain controller IPs
      ... I'm not sure if Al agrees but, You can try to stop the KDC service on all ... the DCs and reset the secure channel on each DC using the netdom command. ... After resetting the secure channel password, you can reboot the server. ...
      (microsoft.public.windows.server.active_directory)
    • Re: One way replication
      ... Secure channel between the DCs ... Can you access the shares on 2003 dc from 2000 dc ... Under Default Domain Controller Security Policy - "Access this ...
      (microsoft.public.windows.server.active_directory)
    • RE: Windows 2003 Replication failes from forest root to 2nd DNS tree.
      ... Security rights like "Access the computer from the network" does not have ... e) if you try to access the failing DCs or vice versa ie (from failing DCs ... If the times are ok between the DCs and you resetting the secure channel ...
      (microsoft.public.windows.server.active_directory)
    • Re: Remote site w/o VPN?
      ... DCs setup a secure channel for doing replication. ... The replication traffic is usally also compress between sites (but ... (phone on web site) ...
      (microsoft.public.win2000.active_directory)
    • Re: [opensuse] Problems setting up Samba-3 as PDC
      ... Digitally encrypt or sign secure channel (always)" ... entry) and 2) disable "Domain member: ...
      (SuSE)