Windows 10 Support
Author
Background
Windows 10 was released in July 2015. Due to changes in the way that trust relationships are established with domain controllers, some modifications to the windows registry needs to take place.
Microsoft How To detect, enable and disable SMBv1, SMBv2, and SMBv3 in Windows
Join a Window 10 client to SME Server 9 or 10
Previously you needed to edit your Win10 registry to facilitate the joining of a SME Server Domain, however this can more easily be achieved by importing win10samba.reg fix by using either a usb key or by the network with http.
- Save the Win10 registry patch (win10samba.reg) from https://your-server-ip/server-resources/regedit/ with your favourite web browser
- On your windows desktop, start "regedit" from the start menu and import the win10samba.reg
- Set your domain instead of your workgroup. Add the client machine to the domain as normal.
- When asked on your Windows PC use the 'admin' username and your SME Server admins password.
- You have to reboot your computer to reach the domain
Using PowerShell
As seen on https://forums.contribs.org/index.php/topic,54125.0.html there are another way (maybe both are needed - need verification):
Start Powershell:
Powershell
Run as superuser:
start-process powershell –verb runAs
Check Client settings:
Get-WindowsOptionalFeature -Online -FeatureName "SMB1Protocol"
Enable SMB1:
Enable-WindowsOptionalFeature -Online -FeatureName "SMB1Protocol" -All
If you want to disable it:
Disable-WindowsOptionalFeature -Online -FeatureName "SMB1Protocol"
Source: https://winaero.com/blog/enable-smb1-sharig-protocol-windows-10/
(*) Admin or any user in the 'Domain Admins' group can join the domain.
MS Windows workgroup configuration
Go to the "start menu", right click on computer, select "System", select the link "System Info", then click on "Change settings" Tab. In the field for "Computer name, domain and workgroup settings", type your "workgroup".
Adding a Microsoft account to your domain account
If you want to be automatically signed into Microsoft's Cloud services (like you would when you login to Windows 10 with a Microsoft Account) you can add your Microsoft Account to your Domain account:
- Go to: Start > Settings > Accounts > Your account
- Scroll down to the section: 'Other accounts you use'
- Click on the 'Add a Microsoft account' link and supply your credentials
Setting up network drives
If you are using SME Server as a domain controller and the workstations have joined the domain you can automate drive mapping and syncronise the PC time with the netlogon.bat file
Note: Chapter 13 has a method for admin to edit the netlogon.bat file without using the command line. You can consider also the chapter 7 on Configuring the Computers on Your Network
nano -w /home/e-smith/files/samba/netlogon/netlogon.bat
REM To set the time when clients logon to the domain: net time \\servername /set /yes REM To map a home directory to drive h: net use h: /home /persistent:no net use j: \\servername\ibay1 /persistent:no net use p: \\servername\ibay2 /persistent:no if exist Z: net use Z: /del /yes
and reset file to dos format
unix2dos /home/e-smith/files/samba/netlogon/netlogon.bat
Outlook 2016 on Win10
for both SME9 Bugzilla:10106 and SME10 Bugzilla:10169 a registry modification has been added to the default win10samba.reg. While setting up an email account on a windows 10 computer joined to a domain
(with roaming profiles) you would get an error code: 0x8004011c without this.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb] "ProtectionPolicy"=dword:00000001
notes about Window 10 and SME Server 10
As reported in Bugzilla:9555, with default configuration while samba 4.4.4-12 should be able to use SMB3_11 protocol and Windows 10 should ask for it, it could occurs that the negotiation fails, if so, please report.However, there seems two way to workaround this. First by editing the registry of windows clients:
config setprop smb ServerMaxProtocol NT1 expand-template /etc/smb.conf service smb restart
An alternative would have been to patch the registry of every windows 10 client with the following:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\ParametersRegistry] "SMB1"=dword:00000001 "SMB2"=dword:00000000
reverting win10samba.reg changes
If you need to revert back the win10samba.reg changes, this is the batch to do it:
@echo off reg delete HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManWorkstation\Parameters /v "DNSNameResolutionRequired" /f reg delete HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManWorkstation\Parameters /v "DomainCompatibilityMode" /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths /v "\\\\*\\netlogon" /f reg delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ProfSvc\Parameters /v "UseProfilePathExtensionVersion" /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System /v "SlowLinkDetectEnabled" /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System /v "DeleteRoamingCache" /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System /v "WaitForNetwork" /f reg delete HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System /v "CompatibleRUPSecurity" /f
Windows 10 update error when using ESET products and can't access SME SERVER : SSL_ERROR_BAD_CERT_ALERT
See Bugzilla:9205 and forum post https://forums.contribs.org/index.php/topic,53813.0.html
Re issues when ESET products are installed on Windows 10