# LAN shares and SMB versions: why \\NAS disappeared

> Share versus NTFS permissions, the SMB1 removal that broke old devices, and the guest-access default that blocks NAS logins.

**Tested on**

- Build: 26300.9457 / 26100.33650
- Edition: Pro (26H2) / Server
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-29

## The short answer

Three independent layers decide whether `\\NAS\share` opens:

| Layer | Question |
|---|---|
| **Name resolution** | can the client turn `NAS` into an IP? |
| **SMB protocol version** | does the device speak something Windows still allows? |
| **Authentication** | is the account allowed, and is guest access permitted? |

Windows changed the defaults on the last two, which is why shares that "worked for years" stopped.

## Layer 1: name resolution

```powershell
Resolve-DnsName nas -ErrorAction SilentlyContinue
Test-NetConnection nas -Port 445
Test-NetConnection 192.168.50.10 -Port 445
```

If the IP works and the name does not, it is name resolution — not SMB. Use the IP, add a hosts entry, or fix DNS on the router.

## Layer 2: SMB versions

| Version | Status on Windows 11/Server 2025 |
|---|---|
| **SMB1** | disabled by default, removal supported |
| **SMB2** | enabled |
| **SMB3** | enabled, encryption capable |

Old NAS boxes and printers still speak SMB1. Enabling it re-introduces a protocol with known weaknesses — do it only for a device you cannot replace, and only on a trusted LAN.

```powershell
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol,EnableSMB2Protocol,RequireSecuritySignature,EncryptData
Get-SmbClientConfiguration | Select-Object RequireSecuritySignature,EnableInsecureGuestLogons
```

## Layer 3: guest access is blocked

Since Windows 10 1709, **insecure guest logons** are disabled: a share that allows anonymous access is refused with "you can't access this shared folder because your organization's security policies block unauthenticated guest access".

Two honest options:

1. **Create a real account on the NAS** and connect with credentials (correct).
2. Re-enable insecure guest logons (quick, weak — the share becomes readable by anyone on the LAN).

```powershell
# the policy that produces that message
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters' -Name AllowInsecureGuestAuth -ErrorAction SilentlyContinue
```

> **Caution: Guest access is not 「just convenience」**
>
> An anonymous SMB share is readable by every device on the network — including a compromised IoT gadget. If a NAS only offers guest access, put it on a separate VLAN rather than re-enabling guest logons globally.

## Creating a share correctly

Share permissions and NTFS permissions are **both** applied; the effective permission is the more restrictive.

```powershell
New-Item -ItemType Directory -Path D:\Shares\Team -Force
New-SmbShare -Name Team -Path D:\Shares\Team -FullAccess 'DOMAIN\Admins' -ChangeAccess 'DOMAIN\Staff'
Grant-SmbShareAccess -Name Team -AccountName 'DOMAIN\Staff' -AccessRight Change -Force
```

Rule of thumb: give **Everyone / Full** at the share level and control access with **NTFS**. Two permission systems fighting each other is the most common "but I gave them access" problem.

## Who is connected right now

```powershell
Get-SmbSession | Select-Object ClientComputerName,ClientUserName,NumOpens
Get-SmbOpenFile | Select-Object ClientUserName,Path
```

To kick a stale session: `Close-SmbSession -ClientComputerName 192.168.50.20 -Force` (closes that client's open files).

## Related

- [Remote Desktop host setup](https://windows.homes/en/windows/remote/rdp-host/)
- [Printing and scanning](https://windows.homes/en/windows/peripherals/printing/)
- [Network hardware for a homelab](https://windows.homes/en/hardware/homelab/network-hardware/)

## Lab boundary

E1. SMB defaults and cmdlets are Microsoft-documented. The lab VMs share nothing over SMB, so no share fault was reproduced.

## Sources

- [Microsoft Learn — New-SmbShare](https://learn.microsoft.com/en-us/powershell/module/smbshare/new-smbshare)
- [Microsoft Learn — Get-SmbSession](https://learn.microsoft.com/en-us/powershell/module/smbshare/get-smbsession)
- [Microsoft Learn — Troubleshoot Windows client](https://learn.microsoft.com/en-us/troubleshoot/windows-client/)

---

Source: https://windows.homes/en/windows/remote/smb-shares/