Sun Storage 7000 Unified Storage System: After customer upgrades SMB clients from Windows XP to Windows 7, they can't access the shares

Asset ID:	1-72-1492446.1
Update Date:	2012-09-20
Keywords:

Solution Type Problem Resolution Sure

Solution 1492446.1 : Sun Storage 7000 Unified Storage System: After customer upgrades SMB clients from Windows XP to Windows 7, they can't access the shares

Applies to:

Sun ZFS Storage 7320 - Version All Versions and later
Sun ZFS Storage 7120 - Version All Versions and later
Sun ZFS Storage 7420 - Version All Versions and later
Sun Storage 7410 Unified Storage System - Version All Versions and later
Sun Storage 7310 Unified Storage System - Version All Versions and later
7000 Appliance OS (Fishworks)
Microsoft Windows x64 (64-bit) - OS Version: 7

Symptoms

Windows 7 client unable to access shares or map drives after upgrade from Windows XP to Windows 7

Changes

Customer upgraded clients from Windows XP Pro to Windows 7.

Cause

Secure Customer upgraded his Windows clients from Windows XP Pro to Windows 7. The shares from the 7120 storage appliance had been available to the XP clients. After the customer upgraded and applied his group security policy they were no longer available.

In examining a packet capture from the clients we see the following in the packet capture for a working vs non-working client

working - Flags2: 0xc807
non-working - Flags2: 0xc817

The bit that is set in the capture of the non-working system (Windows 7) is "SMB_FLAGS2_SMB_SECURITY_SIGNATURE_REQUIRED". This indicates that SMB packet signing is required by the client.

Solution

In the BUI Configuration -> Services -> SMB, the box marked "Signing Enabled" was not checked. Checking this box and pressing Apply enabled his Windows 7 clients to access the shares.

Without a packet capture, you can also determine if signing needs to be enabled by examining or having the customer examine his Group Policy. If the entry, "Domain member: Digitally encrypt or sign secure channel data (always) is in the Category "Domain Member" in the policy, then SMB signing must be enabled on the appliance.

it is unknown why only Windows 7 clients failed, because "Domain member: Digitally encrypt or sign secure channel data (always)" is also supported in Windows XP Pro.

Domain member: Digitally encrypt or sign secure channel data (always) Enabled

It seems likely that the Group Policy was changed between the two installations.

References

<NOTE:1408716.1> - Sun Storage 7000 Unified Storage System: How to Troubleshoot SMB (CIFS) problems
<NOTE:1402353.1> - Sun Storage 7000 Unified Storage System: How to Troubleshoot Active Directory Issues
<NOTE:1402313.1> - Sun Storage 7000 Unified Storage System: ZFS Storage Appliance unable to join/reconnect to Active Directory Domain after upgrade to 2011.1

Attachments

This solution has no attachment