⌚ About 2 min read
The diagnosis must separate network, authentication and SMB compatibility.
Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.
Étapes à suivre
-
1
Test Target
From a post, go to sharing with the same account.
-
2
Check DNS/IP
Ensure that the multifunction reaches the server.
-
3
Read 4625
Look for refusals, authentication.
-
4
Control SMB
Check version and method of supported authentication.
Commands utiles
Test-Net-Gone-Meeting Server -Port 445
À retenir
- Use a dedicated service account.
- Avoid SMB1 unless temporary restraint is documented.
SMB: validate port, authentication, permissions and dialect separately
Technical checkpoints
- TCP/445 reachability is necessary but does not validate authentication or share/NTFS permissions.
- Effective access combines share and NTFS permissions; the most restrictive result applies.
- SMB Signing and negotiated dialect can explain differences between legacy devices/scanners and modern Windows.
Test chain
Test name/IP, port 445, then share access using the same account as the device.
Test-NetConnection server -Port 445
Get-SmbConnection
net use \\server\share /user:DOMAIN\accountTopic-specific pitfalls
- Testing with an administrator often hides service-account permission problems.
- Re-enabling SMB1 for an old scanner greatly increases attack surface; prefer firmware update/replacement.
How to validate
- The same account used by the application/scanner can create and read a test file in the intended folder.
- Negotiated dialect/signing match the expected security policy.