SMB Backup Location

[Alphabetic]

DC uses LAN Manager Authentication default value is 3 I believe which only responds to NTLMv2 authentication. Im going to change this value to 2 which will accept NTLMv1 and LM authentication but will use NTLMv2 if possible. Will get back to you once the server has rebooted.

https://docs.microsoft.com/en-us/wi...ork-security-lan-manager-authentication-level

HKLM\System\CurrentControlSet\Control\Lsa\LmCompatibilityLevel

 

[Alphabetic]

After testing, this is not the setting causing the issue.

 

[Alphabetic]

I've found the cause.

Local security policy of "Microsoft Network Server: Digitally sign communications (Always)" when this is set to ENABLED then you cannot SMB from 3CX.

This is enforced in the default domain controller GPO.

Without reducing security on the DC I think the Linux side needs to be reconfigured somewhere.

 

[NickD_3CX]

We did some preliminary checks and it looks like the library we are using for SMB does not support SMB signing, so as @kieferschild found, option "Microsoft Network Server: Digitally sign communications (Always)" needs to be disabled.
This apparently is by default enabled on DCs.

We will check though if the library can support this, but for the time being it is best to not have a network share on a DC. The alternative would be to disable this option, but I am not sure if this is a good idea from a security perspective...

 

[NickD_3CX]

Good news guys, we have found a solution to this, so in Update 5 we should be able to deal with SMB with the "Microsoft Network Server: Digitally sign communications (Always)" option enabled.

 

[Alphabetic]

Excellent news

 

[Evolute IT]

Good news guys, we have found a solution to this, so in Update 5 we should be able to deal with SMB with the "Microsoft Network Server: Digitally sign communications (Always)" option enabled.

Thanks for updating us!

 

[zSeriesGuy]

Excellent!!! Thank you so much.