Scan-to-Network (SMB) fails after hardening — fix NTLMv2 & share permissions
Joe B.
Expert ★★★★★ 27,853 satisfied customers
Specialities: Windows Server, Windows 11/10, MFPs, SMB2/SMB3, NTLMv2, Kerberos, Group Policy, Zero Trust
Scan-to-Network SMB fails after hardening — NTLMv2-only, Kerberos, SMB signing & secure share permissions
Technician
We’ll map your MFP to a hardened SMB2/SMB3 share using NTLMv2-only or Kerberos, proper share & NTFS permissions, and compatible authentication settings.
Quick checks: after the GPO / baseline changes, does the panel show “Cannot connect to server”, “Login failure”, “SMB authentication error”, or “Scan to network folder failed”? And are you scanning to a Windows Server file share, a NAS, or a Windows 10/11 workstation?
\\FS01\\Scans. We just get “Authentication failed” or “Cannot connect to SMB server”.
Technician
Once you enforce NTLMv2-only, strict SMB signing, and disable legacy protocols, older or misconfigured MFPs may:
• still try SMB1 or NTLMv1,
• send the wrong username format (missing domain / UPN),
• hit a share where the scan account only has Read,
• fail Kerberos because of DNS / SPN mismatch when using server name.
We’ll fix it by: 1) validating your scan service account, 2) correcting share & NTFS permissions, 3) configuring the device for SMB2/SMB3 with NTLMv2 or Kerberos, 4) checking key GPO / security options.
Technician
• Create/confirm a domain account, e.g.
svc_scan.• Share permissions on
\\FS01\\Scans: give svc_scan Change (or Full Control) — not just Read.• NTFS permissions on the Scans folder: at minimum Modify for
svc_scan so it can create/write files and folders.• On the MFP, set the username as
DOMAIN\svc_scan or UPN (svc_scan@yourdomain.com) — this is critical for NTLMv2 and Kerberos to validate properly on hardened systems.
DOMAIN\svc_scan on the device, but it still fails. Could SMB version or signing settings be the problem?
Technician
On the MFP web interface / panel:
• Set SMB protocol to SMB2/SMB3 if available; never force SMB1.
• Ensure NTLMv2 (or “NTLMv2 only”) is enabled for SMB authentication.
• If your GPO enforces SMB signing, enable “Require SMB signing” or “Message signing” on devices that support it.
On the server / GPO:
• Confirm “Network security: LAN Manager authentication level” is compatible with NTLMv2 (e.g., “Send NTLMv2 response only”).
• Avoid forcing settings that your specific MFP model can’t meet. If unsure, we can map each model against Microsoft’s SMB hardening guidelines in a quick chat.
Technician
• Recommended: use the fully qualified UNC path, e.g.
\\fs01.yourdomain.com\Scans.• On some older MFPs that don’t do Kerberos correctly, testing with
\\SERVER-IP\Scans forces NTLMv2 and avoids SPN confusion.• Make sure DNS resolves the hostname from the MFP network; broken DNS or incorrect suffix can cause Scan-to-Network SMB connection failed even with correct creds.
If using hostname works on PCs but not on MFPs, we decide whether to keep Kerberos or go with NTLMv2-only for that scan account.
Technician
Secure-ish options without weakening the whole domain:
• Use an isolated intermediate share host (e.g., a hardened PC or small VM) where SMB1 is enabled only internally, and let it drop files to a secure SMB3 share.
• Restrict that host with firewall rules, strong local creds, and segmentation.
• Long-term: plan to replace devices that cannot do SMB2/SMB3 + NTLMv2 — they will keep breaking as Windows SMB hardening tightens.
We never recommend re-enabling SMB1 on production file servers just to keep Scan-to-Folder alive.
Technician
On your NAS (Synology, QNAP, etc.):
• Disable SMB1; enable SMB2/SMB3 only.
• Enforce NTLMv2 and create a dedicated scan user with write permissions on the scan share.
• Match the authentication requirements on NAS and domain so the MFP isn’t stuck between incompatible policies.
Many “scan to NAS failed after hardening” cases end up being a mismatch between NAS SMB min/max versions and your new domain NTLM policy.
Technician
• On the file server, check Security log for failed logons from the MFP IP — look for NTLM vs Kerberos, and status codes like
0xC000006A (bad password) or 0xC0000193 (expired).• From a PC, run
runas /user:DOMAIN\svc_scan cmd and access \\FS01\Scans — if that works, your NTLMv2 credentials & share/NTFS permissions are fine; the issue is MFP configuration.• If both fail, we adjust GPO security options, especially LAN Manager level and “Network security: Restrict NTLM” rules, for the scan account/subnet.
Technician
• Map each HP / Ricoh / Kyocera / Canon / Lexmark MFP to your NTLMv2-only and SMB3 policies,
• Confirm secure Scan-to-Folder works for every device without weakening your hardening baseline.
Summary: To fix Scan-to-Network (SMB) fails after hardening, use a dedicated scan account, correct share & NTFS permissions, configure MFPs for SMB2/SMB3 + NTLMv2 or Kerberos, align with SMB signing, and verify via server logs. Need help matching settings per model? Open the chat.
Quick answer: the accepted fix
Accepted fix when Scan-to-Network (SMB) breaks after hardening: use a dedicated scan account, grant proper share & NTFS write/modify rights, configure the MFP for SMB2/SMB3 with NTLMv2 or Kerberos, match SMB signing settings, and test with UNC path. Avoid re-enabling SMB1; adjust legacy devices via isolated relay hosts instead.
Why Scan-to-Network (SMB) fails after NTLMv2/Kerberos hardening
Hardening baselines change how SMB authentication works. Enforcing NTLMv2-only, strict SMB signing, disabling SMB1, or configuring “Network security: Restrict NTLM” can break MFPs that still use legacy protocols or wrong credentials. Typical scan-to-folder failure reasons: NTLMv1 attempts blocked, missing write permissions, using local instead of domain account, old firmware sending unsupported SMB dialects, or Kerberos failures due to DNS/SPN mismatch. Fixing compatibility on both the file server / NAS and the MFP restores secure Scan-to-Network without reducing security.
How to verify your hardened Scan-to-Folder setup
After configuration, start a test scan to the network folder. Confirm that files appear instantly under the correct user. From a PC, sign in as the scan account and access the same path; if that fails, adjust share & NTFS permissions. On Windows Server or your NAS, review logs for successful NTLMv2 or Kerberos authentications from the MFP IP. When logs show successful auth and your folder contains new PDFs/TIFFs, your Scan-to-Network SMB is aligned with the hardening policy.
Scan-to-Network security tips (without breaking SMB)
You can keep NTLMv2/Kerberos and SMB3 hardening — and still have reliable scan-to-folder.
Practical sequence: create a dedicated scan account → grant least-privilege Modify rights → enforce SMB2/SMB3 and NTLMv2-only → match SMB signing on both sides → adjust each MFP’s SMB settings → verify via logs. This approach fixes most “Scan-to-Network (SMB) fails after hardening” incidents while staying compliant with modern security baselines.
Disclaimer: This information is AI-generated and intended for general guidance only. For complex domains and compliance environments, please consult a verified expert on Whizz-Tech before changing security policies.
Getting Started Is Easy
Ask for help, 24/7
Members enjoy round-the-clock access to 12,000+ verified Experts, including IT, networking, cybersecurity, and printer support.
Expert will respond in minutes
We match you with an Expert who specializes in scan-to-folder, SMB, NTLMv2, Kerberos, and secure file server configuration.
Save time & keep security
No need to drop hardening or expose SMB1. Get a compliant fix that keeps Scan-to-Network working and your data safe.
FAQ
Why did Scan-to-Network (SMB) stop working after hardening?
Security baselines often disable SMB1/NTLMv1, enforce NTLMv2-only and SMB signing. MFPs or NAS devices that still use legacy SMB or have wrong share/NTFS permissions start failing authentication.
How do I fix Scan-to-Folder on Windows Server with NTLMv2-only?
Use a dedicated scan account, grant Modify on the share and folder, set the device to SMB2/SMB3 with NTLMv2, use DOMAIN\username or UPN, and confirm policies allow that account.
Should I re-enable SMB1 to restore Scan-to-Network?
No. Instead, enable SMB2/3 on the device, adjust NTLMv2 and SMB signing, or use an isolated relay host for truly legacy devices. Avoid weakening the primary file server.
Does this work with NAS devices like Synology or QNAP?
Yes. Configure NAS SMB to SMB2/3 only, require NTLMv2, create a scan account with write rights, and match your AD or local policies. Most “scan to NAS failed after hardening” cases are fixable.
| Symptom | Likely cause | Quick fix |
|---|---|---|
| “Cannot connect to SMB server” | Device using SMB1 or wrong UNC path | Switch to SMB2/3, use \\server\share or FQDN; check DNS. |
| “Authentication failed” / login error | Blocked NTLMv1, bad username format, or missing rights | Use DOMAIN\scanaccount or UPN; enforce NTLMv2; grant Modify on share & NTFS. |
| Works to Windows PC, fails to NAS | NAS SMB/NTLM settings don’t match domain policy | Align NAS to SMB2/3 + NTLMv2; create proper scan account. |
| Legacy MFP fails after SMB1 disabled | Device only supports SMB1/NTLMv1 | Use isolated relay host or replace device; don’t re-enable SMB1 globally. |
Step-by-step (Windows Server / Windows 11 share)
- Create or confirm a dedicated scan account (domain or local as required).
- Grant the scan account Change/Modify on share & NTFS for the scan folder.
- Ensure the server and device use SMB2/SMB3 and NTLMv2; confirm policies allow it.
- On the MFP, configure UNC path (FQDN or IP), correct username format, and enable SMB signing if required.
- Test a scan; review Security logs for successful NTLMv2/Kerberos events from the device IP.
Note for mixed environments (macOS & SMB shares)
- Ensure the SMB share used by macOS and MFPs runs SMB2/3 with NTLMv2/Kerberos compatible settings.
- Use the same dedicated scan account or group-based permissions to avoid mismatched rights across platforms.
Sources
- Microsoft — SMB security & hardening overview
- Microsoft — LAN Manager authentication level
- Microsoft — NTLM authentication behavior
Filed under: Network security / VPN / office policies (advanced)
Related articles
- Ricoh SMB scan works but print fails — AES signing mismatch
- Your Synology SMB Scan Keeps Failing — Stop the Silence and Find the Real Cause
- Scan to SMB Stopped Working After NTLMv1 Was Disabled — What Needs Changing and Where to Find the Settings
- Scan to Folder Fails Over SMB3 — Fix Guide
- Wi-Fi Stops Working After Connecting to VPN — step-by-step fix
- iOS Lost Printer After Update — Fix & Re-Add Guide
- Printer won’t print prescriptions or medical reports — it’s urgent and nothing comes out
- Chrome managed profile watermark prints wrong — policy override checks you can do safely