Situation: The client just upgraded their QNAP NAS. After that they can’t access QNAP on one of servers. They find the QNAP is setup to use SMB2 or above. So, they disable the SMB1 on the server. After restarting the server, Workstation and Netlogon services won’t start so that they can’t access network sharing and RDP doesn’t work.
Troubleshooting 1:
Workstation service is still depended on SMB. If you want to disable SMB1, you must allow SMB2/3 to function. These are what you want to do:
-flag SMB1 for disabled on the Server service.
-flag SMB2 for enabled on the Server service.
-changes the dependencies for the workstation service to no longer require SMB1 services (mrxsmb10).
-disables the mrxsmb10 service from starting.
-sets the mrxsmb20 service to auto-start
The right commands should look like this:
Set-itemproperty -path “HKLM:\System\CurrentControlSet\Services\LanmanServer\Parameters” SMB1 -Type Dword -Value 0 -Force
Set-itemProperty -path “HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters” SMB2 -Type Dword -Value 1 -Force
Set-itemProperty -path “HKLM:\SYSTEM\CurrentControlSet\services\lanmanworkstation” -name “DependOnService” -value “Bowser”, “MRxSmb20”, “NSI” -type MultiString
Set-itemProperty -path “HKLM:\SYSTEM\CurrentControlSet\services\mrxsmb10” -name “Start” -type Dword -Value 4 -Force
Set-itemProperty -path “HKLM:\SYSTEM\CurrentControlSet\services\mrxsmb20” -name “Start” -type Dword -Value 2 -Force
Troubleshooting 2: Correct mrxsmb and mrxsmb20 registry HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services.
ErrorControl is a type REG_DWORD which specifies how to proceed if the driver fails to load or to initialize properly:
| Value | D e s c r i p t i o n |
| 0 | Ignore: If the driver fails to load or initialize, startup proceeds, and no warning message appears. |
| 1 | Normal: If the driver fails to load or initialize, startup proceeds, but a warning message appears. |
| 2 | Severe: If the driver fails to load or initialize, declares the startup as having failed and restarts by using the LastKnownGood control set. If startup is already using the LastKnownGood control set, continues startup. |
| 3 | Critical: If the driver fails to load or initialize, declares the startup as having failed and restarts by by using the LastKnownGood control set. If startup is already using the LastKnownGood control set, stops startup and runs a debugging program. |
ImagePath is a type REG_EXPAND_SZ that contains the full path to the executable. This entry is not used for network adapters.
ObjectName is a type REG_DWORD which contains the account name for services or the driver object that the I/O manager uses to load the device driver.
Start is a type REG_DWORD which specifies how the service is loaded or started. If the service is a Win32 service, the value of Start must be 2, 3, or 4. This value entry is not used for network adapters.
| Value | D e s c r i p t i o n |
| 0 | Boot: Loaded by kernel loader. Components of the driver stack for the boot (startup) volume must be loaded by the kernel loader. |
| 1 | System: Loaded by I/O subsystem. Specifies that the driver is loaded at kernel initialization. |
| 2 | Automatic: Loaded by Service Control Manager. Specifies that the service is loaded or started automatically. |
| 3 | Manual:. The service does not start until the user starts it manually, such as by using Services or Devices in Control Panel. |
| 4 | Disabled: Specifies that the service should not be started. |
Type is a type REG_DWORD that specifies what this object represents:
| Value | D e s c r i p t i o n |
| 1 | A kernel-mode device driver. |
| 2 | A file system driver. |
| 4 | A set of arguments for an adapter. |
| 8 | A file system driver service, such as a file system recognizer. |
| 16 (0x10) | A Win32 program that runs in a process by itself. This type of Win32 service.can be started by the Service Controller. |
| 32 (0x20 | A Win32 program that shares a process. This type of Win32 service can be started by the Service Controller. |
| 272 (0x110) | A Win32 program that runs in a process by itself (like Type16) and can interact with users. |
| 288 (0x120) | A Win32 program that shares a process and can interact with users. |
For example
