[FIXED] Can't browse for TS-109 Pro in Windows Workgroup

[cb95014]

I have two TS-109 Pros on the same network, and neither is visible on XP Pro or Vista (Ultimate & Home Premium) clients. I was hopeful that the latest 1.1.5 firmware would fix the problem, but no joy. I have power-cycled the QNAP units and clients multiple times. Per comments from Andy in another thread, I have also tried disabling and then re-enabling Windows networking on the TS-109s. I have tried variously enabling and disabling WINS (which should not make a difference in a workgroup...) and Domain Master (which also should not apply in a workgroup...). The Workgroup name is correct, and the server name is legal (e.g.: 'NAS-1TB').

I can:

1) Start -> Run -> \\xxx.xxx.xxx.xxx and access all the shares, &
2) Map to \\xxx.xxx.xxx.xxx and access all the shares

However, I can not:

1) Start -> Run -> \\Server-Name ("The network path was not found"), or
2) *Browse* the network and find the QNAP

More important, the connection must be re-initialized manually at least once per day. This is creating repeated failures in my automatic rsync backup process, which is the entire reason that I bought these.

The results are the same whether I have only one client (XP Pro, or Vista Ultimate, or Vista Home Premium) attached to the network, or all of my clients active. I don't think this is a Microsoft issue, since I have a D-Link DNS-323 on the same network, and that is instantly recognized on any of the clients as soon as I power it up. Each of my clients can also browse all of the others, but none of them can browse to the QNAP NAS.

I love the rich features on the TS-109 Pro, but this flaky basic file sharing is making these devices nearly useless - and driving me crazy...

Any suggestions? Please??

Chris

[AllTheGearButNoIdea]

This post is on topic for me too but......

Hello?

Obviously no one here either

[roschdworschd]

i believe, its a firewall prob of your windows

the workgroup name is the same? (case sensitiv)
ip and subnet ok.....


wins and domain master - you dont need this now


i have al little idea : i hope, i can this descripe in english

if you have no firewall aktivatet, and no virusscan or so...

in the network - card settings from windows, go to your lan - connection, right click, properties, register extented, windows firewall setting ,,

ok, you say, it is disabled, but the trick : go to setup button there and
disable the bindings from the network- hardware!
save it
then try again ...

edit : oh, you can see the other hardware...hmmm...
an other way to try is disable dhcp, manual setting ip to test, or
better, crosslink-direkt connection with one pc or laptop to test it.
look in your network details after login, how long is your leasetime
for the ip - adress (one day? !)

[AllTheGearButNoIdea]

Thanks roschdworschd,

Seems to have been solved by changing the NTLMv2 protocol.

Run secpol.msc

Go to: Local Policies > Security Options


Find "Network Security: LAN Manager authentication level"

Change Setting from "Send NTLMv2 response only"
to
"Send LM & NTLM - use NTLMv2 session security if negotiated"

From here

Now I can put my AV and firewall back in place

[roschdworschd]

auha..... there was a info in the mcse - newsletter.....

thanks for the info! ... i will remember

[cb95014]

I tried:
1) NTLMv2 setting (NTLMv2 required => NTLMv2 if available)
2) Registry tweak (HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters - EnablePlainTextPassword)
3) Turning-off Windows firewall, including the settings on the network ports

I'm glad for you guys, but no change for me...

I would suspect Windows (XP & Vista) issues, except that the Samba-based DNS-323 *instantly* pops-up on the Network Neighborhood of all of the clients as soon as I power it up.

Something is different with the QNAP TS-109.

The Samba - MSDN thread was interesting & I found one post that has clues I have not seen before:

"Hi, I went through the net for some months and finally came accross this http://lists.samba.org/archive/samba/20 ... 76227.html

It's about a line in smb.conf file: valid users = %S which should be (at least in my case): users = %S

After this change I was able to FINALLY connect from Vista to Samba!"

Does this ring a bell? Any more ideas, please??

Chris

[AndyChuo]

Try turning on the 'Domain Master' option down the bottom of 'Network Settings' > 'Microsoft Networking'. Also change the 'workgroup' name to 'WORKGROUP' if you like.

Let me know if it works for you

[Eraser-EMC2-]

Try this : http://www.builderau.com.au/blogs/codemonkeybusiness/viewblogpost.htm?p=339270746

I think, samba don't support NTLMv2 at this time

EDIT:

samba supports NTLMv2, but is disabled on default:

Code: Select all

client ntlmv2 auth (G)

    This parameter determines whether or not smbclient(8) will attempt to authenticate itself to servers using the NTLMv2 encrypted password response.

    If enabled, only an NTLMv2 and LMv2 response (both much more secure than earlier versions) will be sent. Many servers (including NT4 < SP4, Win9x and Samba 2.2) are not compatible with NTLMv2.

    Similarly, if enabled, NTLMv1, client lanman auth and client plaintext auth authentication will be disabled. This also disables share-level authentication.

    If disabled, an NTLM response (and possibly a LANMAN response) will be sent by the client, depending on the value of client lanman auth.

    Note that some sites (particularly those following 'best practice' security polices) only allow NTLMv2 responses, and not the weaker LM or NTLM.

    Default: client ntlmv2 auth = no


I think, it is a good option for the next firmware update.

[cb95014]

Try turning on the 'Domain Master' option down the bottom of 'Network Settings' > 'Microsoft Networking'. Also change the 'workgroup' name to 'WORKGROUP' if you like.

Let me know if it works for you

Unfortunately, no.

I tried this with both an XP machine as well as a shiny new Vista64 installation. I changed the workgroup name to "WORKGROUP" (all caps, since apparently this can affect the ever-twitchy CIFS stack) & edited the NTLMv2 security policy on both to "if available."

Note that as soon as I changed the workgroup back to my normal setting, the DNS-323 popped-up on both machines...

Next?

[AndyChuo]

Try this : http://www.builderau.com.au/blogs/codemonkeybusiness/viewblogpost.htm?p=339270746

I think, samba don't support NTLMv2 at this time

EDIT:

samba supports NTLMv2, but is disabled on default:

Code: Select all

client ntlmv2 auth (G)

    This parameter determines whether or not smbclient(8) will attempt to authenticate itself to servers using the NTLMv2 encrypted password response.

    If enabled, only an NTLMv2 and LMv2 response (both much more secure than earlier versions) will be sent. Many servers (including NT4 < SP4, Win9x and Samba 2.2) are not compatible with NTLMv2.

    Similarly, if enabled, NTLMv1, client lanman auth and client plaintext auth authentication will be disabled. This also disables share-level authentication.

    If disabled, an NTLM response (and possibly a LANMAN response) will be sent by the client, depending on the value of client lanman auth.

    Note that some sites (particularly those following 'best practice' security polices) only allow NTLMv2 responses, and not the weaker LM or NTLM.

    Default: client ntlmv2 auth = no


I think, it is a good option for the next firmware update.

I am thinking to arrange one of our engineer to access directly to your NAS and checking the settings, is that ok for you?
if yes can you PM me your log in infos? (ip, username, password) and dont forget to map port 22, 8080 to one of your NAS and try changing the other to something like 2022, and 2080 for ssh and admin config page respectively and map the corresponding ports too.

thanks

[Eraser-EMC2-]

client ntlmv2 auth (G)

I found out, that will work on a Vista only network, not on a mixed (XP / vIsta ) network.
On a mixed network works only with changing of the security police.

[AndyChuo]

client ntlmv2 auth (G)

I found out, that will work on a Vista only network, not on a mixed (XP / vIsta ) network.
On a mixed network works only with changing of the security police.

can you confirm this?

[Eraser-EMC2-]

Sorry for the inconvenience,
i dont know what happens yesterday.
Today its work fine, again.

I have checked only with XP ( i have no Vista)
now with the setting "Send NTLMv2 response only" in secpol.msc
and it works.

I think, it will work with Vista too.

[AndyChuo]

Hi cb95014,

Can you try again for this?
I think you set a different value for this?

Andy

I tried:
1) NTLMv2 setting (NTLMv2 required => NTLMv2 if available)

I have checked only with XP ( i have no Vista)
now with the setting "Send NTLMv2 response only" in secpol.msc
and it works.

[julius3000]

Hmz, still can't connect to my TS-109 with guest account on it turned off. Gonna look at this thread tomorrow.