Ricoh & Server 2008 SMB Scanning

[Mark]

Question, any advice very welcome.

Windows Server 2008 Small Business Edition. Ricoh MFD's, applies to all of them. Scan to folder does not work. It is not possible to browse to the share from the copier. There is no sharing/NTFS permission errors. The account is a domain admin account.
We have tried editing the settings that affected SMB scanning on Server 2003. We also have a Server 2008 Standard Edition and scanning to shares on this work as normal.

[jneezy2008]

Are you able to browse to the share, on the Small Business Edition, using a workstation?

[john_551]

You can thank MS for this little screw up. Have you done this below.
I have several server 2003/2008 smb set ups using ricoh.

You should also always create a new user name and password for the Rico. I never use the Admin account, bad security.

Dont know if the following is your case, but I have had this issue on Server 2003, SBS 2003, Server 2008 and SBS 2008 when they are configured as domain controllers.
If this server is also a domain controler that is usually caused by the following setting:
Microsoft Network Server: Digitally Sign Communications (Always), The default setting for domain controllers is enabled, for others is not configured or disabled. This usually causes problems when acessing the share from devices are not cable of Digitally Sign Communications, like some multifunctionals/scanners or linux machines. This does not happen on all machines since some are capable of Digitally Sign Communications. Usually older machines have this issue.
So, try to disable this setting on the server, on the Domain controller security policy and Default Domain Policy.

Administrative Tools
Domain controller security policy
Local Policies
Security options
Microsoft Network Server: Digitally signed communication (always) -> should be changed to DISABLE
Execute Gpupdate /force or reboot the server to apply the policy change

You will not be able to change this setting trough gpedit , local computer policy since it is overrided by the Domain security policy.

On server 2008 one way to get there is the following:
Administrative Tools
Server Manager
Features
Group Policy Manager
Forest: ...
Default Domain Policy
Computer configuration
Policies
Windows Settings
Security Settings
Local Policies
Security Options
Microsoft Network Server: Digitally Sign Communications (Always)
- Define This Policy
- Disabled

Execute Gpupdate /force or reboot to apply policy

Trough gpedit you will be able to see the option but not change it, so I suggest that after the change you cannot scan to the folder check trough gpedit if it is disabled.
If it is not disabled, disable it at the top of the hierarchy. Something may be overriding the setting.

If it still does not work try the following, togheter with the previous setting
Domain member: Digitally encrypt or sign secure channel data (always) -> disabled

Dont forget to execute Gpupdate /force or reboot to apply policy each time you change something.

Also

are you scanning to the server using \\server_ip_address\shared_folder or \\server_name\shared_folder?
Just wondering about name resolution.
Is the domain field configured in the machine? if not you might have to specify the user for authentication like for example: user@domain.local

[Mark]

Yeah I tried that, those are the server 2003 settings I was refferring to in my original post.
It only affects 2008 small business server, the other versions work fine.
It applies to all Ricoh MFD's, newer Ricohs can scan to smb on server 2003 without those settings being adjusted anyway.

Yeah I can browse the share from a workstation and from our HP scanners.

[john_551]

Here is a link for MS Technet perhaps this could be of help, it was for me.

Managing Permissions for Shared Folders

This is another possible solution for turning off smb in server 2008.
Disable SMB 2.0 on Windows Server 2008 | Lyle Epstein's Systems Engineer Blog

[n25an]

You can thank MS for this little screw up. Have you done this below.
I have several server 2003/2008 smb set ups using ricoh.

You should also always create a new user name and password for the Rico. I never use the Admin account, bad security.

Dont know if the following is your case, but I have had this issue on Server 2003, SBS 2003, Server 2008 and SBS 2008 when they are configured as domain controllers.
If this server is also a domain controler that is usually caused by the following setting:
Microsoft Network Server: Digitally Sign Communications (Always), The default setting for domain controllers is enabled, for others is not configured or disabled. This usually causes problems when acessing the share from devices are not cable of Digitally Sign Communications, like some multifunctionals/scanners or linux machines. This does not happen on all machines since some are capable of Digitally Sign Communications. Usually older machines have this issue.
So, try to disable this setting on the server, on the Domain controller security policy and Default Domain Policy.

Administrative Tools
Domain controller security policy
Local Policies
Security options
Microsoft Network Server: Digitally signed communication (always) -> should be changed to DISABLE
Execute Gpupdate /force or reboot the server to apply the policy change

You will not be able to change this setting trough gpedit , local computer policy since it is overrided by the Domain security policy.

On server 2008 one way to get there is the following:
Administrative Tools
Server Manager
Features
Group Policy Manager
Forest: ...
Default Domain Policy
Computer configuration
Policies
Windows Settings
Security Settings
Local Policies
Security Options
Microsoft Network Server: Digitally Sign Communications (Always)
- Define This Policy
- Disabled

Execute Gpupdate /force or reboot to apply policy

Trough gpedit you will be able to see the option but not change it, so I suggest that after the change you cannot scan to the folder check trough gpedit if it is disabled.
If it is not disabled, disable it at the top of the hierarchy. Something may be overriding the setting.

If it still does not work try the following, togheter with the previous setting
Domain member: Digitally encrypt or sign secure channel data (always) -> disabled

Dont forget to execute Gpupdate /force or reboot to apply policy each time you change something.

Also

are you scanning to the server using \server_ip_addressshared_folder or \server_nameshared_folder?
Just wondering about name resolution.
Is the domain field configured in the machine? if not you might have to specify the user for authentication like for example: user@domain.local

dude I am a kyocera copier tech and this call of yours saved my JU JU... thanks a million... great call

[user245470]

i had a user name and password with all rights avalible and would get a ce-00 i tried everything in the post didnt work then i moved my user name and made a member of the admin group and it worked so if all else fails try that

[Ralph S]

On the MFP in the address book, start with a New entry. Put in the \\<server Ip Address> for the path to folder, then select browse. It asked me for credentials, even though tihad them already entered in SMB for file transfer. I put in ewhat I needed and was able to se teh shares. I had to do this for EACH scare that I wanted to complete.....3 in my case.

FUN STUFF M$..............

[RoadKing]

What Ricoh models are you scanning from? Older models required the custom firmware for the digital signing required by Windows 2003 (and newer).

[Choro1dal]

If disabling digital signatures does not resolve the issue in a Win 7 or 2K8 environment, try entering the full path to the destination instead of browsing to it. Win 7 and 2K8 use Samba V3.0.23 which is not supported on all Ricoh family MFDs at present.