SMB File Sharing and Printer Sharing Failures — Windows Network Resource Access Blocked

Indicators

• Users cannot access UNC paths (e.g. \\server\share) — 'Network path not found' or 'Access denied' errors
• Network printers show as offline or fail to connect in Devices and Printers
• SMB connection attempts time out or are refused on TCP port 445
• File Explorer cannot browse network neighbourhood or discover shares
• Event IDs 2017, 2019 (non-paged pool exhaustion), 3034 (SMB errors), 7036 (service state changes) in System log

Likely causes

• SMB service (LanmanServer / Server service) stopped or disabled on the host
• Windows Firewall blocking TCP port 445 or UDP ports 137/138 required for SMB and NetBIOS
• SMB protocol version mismatch — SMBv1 disabled on server but client requires it, or vice versa
• Incorrect NTFS or share-level permissions preventing authenticated access
• Authentication failures due to mismatched credentials, expired passwords, or Kerberos/NTLM issues in domain environments
• Print Spooler service stopped or crashing on the print server
• Network adapter or DNS misconfiguration preventing name resolution of the server hostname

Diagnostic steps

1. Verify the Server (LanmanServer) service is running on the file/print server: Get-Service -Name LanmanServer | Select-Object Name, Status, StartType
   Confirms whether the SMB server component is active; if stopped, no shares will be accessible
2. Check Windows Firewall rules for File and Printer Sharing: Get-NetFirewallRule -DisplayGroup 'File and Printer Sharing' | Select-Object DisplayName, Enabled, Direction, Action
   Identifies firewall blocks that would silently drop SMB connection attempts on TCP 445 and NetBIOS ports
3. Verify TCP port 445 reachability from client to server: Test-NetConnection -ComputerName <server> -Port 445
   Confirms network path is open at the transport layer before investigating higher-level SMB issues
4. Check which SMB protocol versions are enabled on the server: Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol, EnableSMB2Protocol
   Identifies SMB version negotiation failures, especially if SMBv1 has been disabled but legacy clients depend on it
5. List current SMB shares and verify share exists with correct permissions: Get-SmbShare | Select-Object Name, Path, Description; Get-SmbShareAccess -Name '<ShareName>'
   Confirms the share is published and that both share-level and NTFS permissions allow the affected user or group
6. For printer sharing failures, verify the Print Spooler service is running: Get-Service -Name Spooler | Select-Object Name, Status, StartType
   A stopped or crashed Print Spooler prevents all printer sharing; this is a common single point of failure
7. Review System and Security event logs for SMB-related errors: Get-WinEvent -LogName System -MaxEvents 100 | Where-Object { $_.Id -in @(2017,2019,3034,7036) } | Select-Object TimeCreated, Id, Message
   Surfaces underlying error conditions such as non-paged pool exhaustion, service crashes, or authentication failures

Resolution path

• 1. If LanmanServer (Server) service is stopped, start it and set to Automatic: Set-Service -Name LanmanServer -StartupType Automatic; Start-Service -Name LanmanServer
• 2. If Print Spooler is stopped, start it and set to Automatic: Set-Service -Name Spooler -StartupType Automatic; Start-Service -Name Spooler
• 3. Enable File and Printer Sharing firewall rules if disabled: Enable-NetFirewallRule -DisplayGroup 'File and Printer Sharing'
• 4. If SMB version mismatch identified, enable SMBv2/v3 on server (avoid re-enabling SMBv1 for security): Set-SmbServerConfiguration -EnableSMB2Protocol $true -Force
• 5. Correct share permissions if access denied: Grant-SmbShareAccess -Name '<ShareName>' -AccountName '<Domain\User>' -AccessRight Full -Force
• 6. Correct NTFS permissions on the underlying folder path using icacls or Set-Acl if share permissions are correct but NTFS denies access: icacls <path> /grant <Domain\User>:(OI)(CI)F

Prevention

• Disable SMBv1 across all servers and clients via Group Policy or Set-SmbServerConfiguration -EnableSMB1Protocol $false to eliminate protocol negotiation and security vulnerabilities
• Enforce baseline firewall policy via Group Policy ensuring File and Printer Sharing rules are consistently applied and not overridden by local policy
• Configure monitoring or alerting on LanmanServer and Spooler service state for proactive detection before user reports
• Audit share and NTFS permissions quarterly to prevent permission drift from causing unexpected access failures

Tools

• Get-SmbServerConfiguration / Set-SmbServerConfiguration — query and configure SMB protocol versions and server settings
• Get-SmbShare / Get-SmbShareAccess / Grant-SmbShareAccess — manage SMB shares and share-level permissions
• Get-SmbSession — view active SMB client sessions on the server
• Get-NetFirewallRule / Enable-NetFirewallRule — manage Windows Firewall rules
• Get-Service / Start-Service / Set-Service — manage Windows services (LanmanServer, Spooler)
• icacls — inspect and modify NTFS file system permissions
• Event Viewer / Get-WinEvent — review System and Security logs for SMB and service errors
• Test-NetConnection — verify TCP port 445 reachability

References

• Microsoft Docs: SMB overview
• Microsoft Docs: Detect, enable, and disable SMBv1, SMBv2, and SMBv3 in Windows
• Microsoft Docs: Troubleshoot SMB connectivity