Windows 8

Unable to Map Drives from Windows 8 and Server 2012

Posted on by Adam Fowler

Hi,

Came across this issue recently and thought it was worth sharing. From a Windows 8 machine, trying to map drives to either Windows Server 2003 or Windows Server 2008 and failing. It was just the generic ‘Windows cannot access *blah*” but the details had ‘System error 2148073478’. Some googling found this Microsoft Support article: http://support.microsoft.com/kb/2686098

First, this only talks about 3rd party SMB v2 file servers which is a bit strange, but applying this client fix fixed it on an individual basis:

  • Disable “Secure Negotiate” on the client. 
    You can do this using PowerShell on a Windows Server 2012 or Windows 8 client, using the command:

    Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters” RequireSecureNegotiate -Value 0 -Force
  • Note: If you get a long access denied error, try running Windows PowerShell as an Administrator.

Fixes it, but not ideal. A better solution may be to disable SMB signing on the particular server you’re connecting to. The next set of instructions are fromExinda: http://support.exinda.com/topic/how-to-disable-smb-signing-on-windows-servers-to-improve-smb-performance

To disable SMB signing on the Windows Server 2000 and 2003 perform the following:

  1. Start the Registry Editor (regedit.exe).
  2. Move to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters.
  3. From the Edit menu select New – DWORD value.
  4. Add the following two values EnableSecuritySignature and RequireSecuritySignature if they do not exist.
  5. You should set to 0 for disable (the default) or 1 to enable. Enabling EnableSecuritySignature means if the client also has SMB signing enabled then that is the preferred communication method, but setting RequireSecuritySignature to enabled means SMB signing MUST be used and so if the client is not SMB signature enabled then communication will fail.
  6. Close the registry editor.
  7. Shut down and restart Windows NT.

In addition, default Domain Controller Security Policies may also force these values to “enabled” on Windows Servers. 

On Windows 2003 Servers, open Domain Controller Security Policy under Administritive Tools. Expand the Local Policies tree, then expand the Security Options tree and look for:Set both of these values to “Disabled”.

  • – Microsoft network server: Digitally sign communications (always)
  • – Microsoft network server: Digitally sign communications (if client agrees)

To disable SMB signing on the Windows Server 2008 and 2008 R2 perform the following: 

Changes need to be applied in the Group Policy management console. 
      Start –> Administrative Tools –> Group Policy Management 
Configure the Default Domain and Default Domain Controller Policies. The settings you are looking for are under: 
      Computer Configuration –> Policies –> Windows Settings –> Security Settings –> LocalPolicies –> Security

 Turning off SMB signing isn’t a best practise security thing to do, but if you need to get out of trouble and it’s only on your internal network then the risk of someone modifying SMB packets in transit is rather low, plus you’ll get a 15% boost due to losing the overhead of SMB signing. This is still a preferred option to just completely disabling it on the client, because at least the client can still do secure SMB to other servers.
Update: Trying this from Windows 8 PC to a Windows 7 PC had a similar issue, but the error code was 0x80004005. Another workaround is running the powershell command Set-SmbClientConfiguration -RequireSecuritySignature $true on the Windows 8 client. This may break other stuff again, if you try to connect to something that doesn’t have a Security Signature. Investigate this for yourself :)
All of the above should apply to Windows Server 2012 too.

Windows 8 – Folder In Use

Posted on by Adam Fowler

Hi,

Since using Windows 8, I’ve had continual issues when trying to move folders around. It’s the normal message saying “Folder In Use – The action can’t be completed because the folder or a file in it is open in another program”

File in Use

I’d get this continually, and quite confident that I didn’t have anything actually open. Eventually I’d try again and after a few tries, it would finally move my folder. I was fed up with this, so thought it was about time to work out what was going on. Someone (thanks Barb) reminded me that Process Explorer was a good way to work out what file was open. I ran Process Explorer, moved a few folders until I recreated the error and did a search for the folder that was in use. I found that explorer.exe had the thumbs.db file open, even though I hadn’t navigated inside the folder.

Thumbs.db? It’s been around for ages (since Windows 95!) and is a thumbnail cache file used for Windows Explorer’s thumbnail view. This was also deprecated from Windows Vista and above, replaced by a centralised thumbnail location instead of dropping the Thumbs.db files all over your hard drive. The problem is, Vista and above still create the old Thumbs.db by default!

Windows 8 seems to be even worse, in that it still creates the file but then keeps it open for a rather long time. After finding this thread on Technet, where I learnt a lot of the above, I enabled the setting “Turn off the caching of thumbnails in hidden thumbs.db files” under > User Configuration > Administrative Templates  > Windows Components   > File Explorer.

After doing this then rebooting, my “Folder In Use” issue seems to have completely cleared. I can understand why this is enabled by default (backwards system compatibility), but it does seem strange that Windows 8 keeps the file open for such a long and random time.

So, as long as you don’t have anything below Vista accessing your files, go ahead and enable the setting.

Update: More detailed instructions from AJ below.

Hit Win+R, type gpedit.msc in the Run window and click OK. The Local Group Policy Editor will be launched.
Navigate through the tree to User Configuration > Administrative Templates > Windows Components > then either Windows Explorer (Windows Vista/7) or File Explorer (Windows 8)
In the right-hand pane, double-click “Turn off the caching of thumbnails in hidden thumbs.db files”.
Select Enabled (don’t make my mistake of choosing “Disabled” — you’re enabling the switching off of Thumbs.db. Not particularly intuitive, Microsoft!)

Update 2: You can also use this registry setting:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer]
"DisableThumbsDBOnNetworkFolders"=dword:00000001

 

Update 3: For those of you unlucky enough to have a Windows 2000 server still, there is an option in Windows 8 allowing connections to 40 bit fileservers. Check this post for details: http://www.eightforums.com/tutorials/9925-file-sharing-connections-encryption-change-settings-windows-8-a.html

Update 4: Here’s a screenshot of the registry after being modified. You can ignore the other entries under ‘Explorer’:

thumbs