[TriLUG] Windows Dropping Mapped Samba Share

[Matt Flyer via TriLUG]

Brian, 

Though without evidence, I do think your theory about connections
getting dropped because it isn't a trusted device is plausible.  Would
it be possible for you to join it to the domain?  Do you have domain
admin credentials?  I have a Linux server on the UNC AD but it is joined
to the domain and SMB connections stay persistent. 

It has been my experience that they're seriously clamping down on the
FOIT domain(s).  For example, even with domain admin credentials I can't
add a printer or install software.  It has gotten so restrictive that
we've had to pull some of our machines out of the domain, which has some
disadvantages such as not getting the updates as regularly.   

If the Linux logs don't show anything, though it gets messy, perhaps you
could run Wireshark and tune it down to just the SMB traffic between
your IP addresses and see if something changes or throws an exception. 

On 2023-05-18 11:15, Brian via TriLUG wrote:

> Hi Gang,
> 
> I'm not getting very far with our in-house IT folks, so I figured I'd tap the great fount of wisdom in this group.
> 
> My workstation is a Windows 10 Pro 21H2 laptop that is a member of an Active Directory domain.
> The server is Debian 11.6 running Samba 2:4.13.13+dfsg-1~deb11u5, and is NOT a domain member.  SMB authentication is handled locally with the smbpasswd mechanism.
> 
> If I access files from Windows using UNC paths, everything is copacetic.
> 
> If I map a drive on Windows, some random period of time later, the drive mapping is silently dropped.  Any application with files open on that mapped drive just sees the file go away.  No events are generated in the Windows Event Log when the disconnect occurs.
> 
> I've set the samba server to "log level = 5" to see if I can discover anything useful there, but I would love any available advice on why this might be happening, and tips on what exactly to look for in the smbd log.
> 
> In particular, I wonder if some Windows domain policy might be periodically coming along and silently nuking the mapped drive because the server isn't trusted in some way.  Is that possible?
> 
> Cheers!
> -Brian