Windows 7, 8 and 2008 File Share and Remote Printer Connections

Updated 10/10/2013

You must be using FacetWin Version 4.0.q (Build 488) or later. This contains the latest improvements for working with Windows 7, 8 and 2008.  If you must upgrade, do so to the current FacetWin release to take advantage of latest improvements and optimizations.

The Problem

Many FacetWin users find that upgrading to Windows 7, 8 or 2008 will cause problems with SMB connections both to and from the UNIX server.  SMB connections to the UNIX server include mapping a drive from a PC to the UNIX server or browsing the shares.  SMB connections from the UNIX server is a connection to a FacetWin remote printer that is shared on a Windows 7, 8 or 2008.

SMB Connections

LANMAN, Plain Text Password, RHOST and Trusted server security methods for FacetWin will not work for Windows 7, 8 or 2008 as it normally does with Windows 2000, XP or 2003. For any of the FacetWin security methods, the following changes need to be made to the Windows 7, 8 or 2008.

1) On the Windows 7, 8 or 2008 PC TCP/IP Properties, "Enable WINS" with the UNIX server's IP address and "Enable NetBIOS over TCP/IP".

2) Security Options and Registry equivalents

   Administrative Tools->
     Local Security Policy->
       Local Policies->
         Security Options->
           Network access: Sharing and security model for local accounts->
             Enable Classic: local users authenticate as themselves

   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
   "forceguest"=dword:00000000

   Administrative Tools->
     Local Security Policy->
       Local Policies->
         Security Options->
           Network security: LAN Manager authentication level->
             Send LM & NTLM - use NTLMv2 session security if negotiated

   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
   "LmCompatibilityLevel"=dword:00000001

   Administrative Tools->
     Local Security Policy->
       Local Policies->
         Security Options->
           Network security: Minimum session security for NTLM SSP->
	     Disable Require 128-bit encryption (client)

   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0]
   "NtlmMinClientSec"=dword:00000000

   Administrative Tools->
     Local Security Policy->
       Local Policies->
         Security Options->
           Network security: Minimum session security for NTLM SSP->
             Disable Require 128-bit encryption (server)

   [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0]
   "NtlmMinServerSec"=dword:00000000

   Administrative Tools->
     Local Security Policy->
       Local Policies->
         Security Options->
           Microsoft Network Client: Digitally sign communications (always):
             Disabled

   [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManWorkStation\parameters]
   "RequireSecuritySignature"=dword:00000000

   Administrative Tools->
     Local Security Policy->
       Local Policies->
         Security Options->
           Microsoft Network Server: Digitally sign communications (always): Disabled

 [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\parameters]
   "RequireSecuritySignature"=dword:00000000

   Administrative Tools
     Local Security Policy
       Local Policies
         Security Options
           Microsoft network client: Send unencrypted passwords to third-party SMB servers: Enabled

 [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkStation\parameters]
 "EnablePlainTextPassword"=dword:00000001