Setup server to accept SMB v1 connections on DNS address (disableStrictNameChecking)

Sunday, July 31, 2011

Setup server to accept SMB v1 connections on DNS address (disableStrictNameChecking)

I have been tidying up a clients infrastructure, and in doing this I have been creating dns entries for certain services. For example I want to take the backup location away from the server name and to a more generic backup name dns address.

note: the environment is isolated and all servers standalone there is no active directory setup. If you are in a windows domain environment you may have to look at setting SPNs. I include some links at the bottom that may help you here.

i.e.

from: \\<servername>
to: \\db-backup.testdomain.com

Now I thought I could just create a new dns entry and point it to the server ip, then using the dns entry in the unc. Now this worked fine for windows 2008 and windows 7 machines and it turns out this is because they are happily using smb v2.

What I found was that the windows 2000 / windows 2003 server then failed to connect to the windows 2008 server. \\<ipAddress> and \\<servername> worked fine but the newly created dns entry would not work. It would resolve fine on the 2003 server but trying to connect via explorer using the unc with the new dns address just failed to connect.

In the end I found that this is because the communication is trying to use SMB v1. To allow this connectivity you have to change a registry setting on the server you are trying to connect to.

So on my windows 2008 server I had to change the following.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters

Value name: DisableStrictNameChecking
Data type: REG_DWORD
Radix: Decimal
Value: 1

Once the server had been restarted, I was able to connect to the server using the dns address.

Below I try to visualise the problem

note: the disableStrictNameCheck will need to be disabled on every server you want to connect to that using smb1. So in essence unless everything is win2k8 and win7 you will have to do this.