In our business we have been using a mix of Windows 10 and 11 Pro for a while, with limited teething issues in the upgrade, however some recently upgraded servers (going straight to 25H2) are unable to access SMB shares between devices. This has been an issue in various departments working from various, direct upgrades, prepped images or clean installs. We're very confident that the cause of the issue is changes in how Windows 11 handles SMB shares, with no changes being made to security policies during this upgrade process. When a share is accessed over the network the file explorer popup states the username or password is incorrect, no matter what is entered. When looking at the Event Logs if the password is correct, then the 4625 event has the details: When the password is deliberately incorrect the event logs show: We've spent a fair amount of time investigating this issue and trying various security policies but with no luck. Is this an issue other people are seeing, is there a known fix that I've not been able to find? You’re right, this is a deeper issue that’s showing up on 25H2 systems and not just a simple signing mismatch. Based on what’s coming out from Microsoft and community reports, the root cause seems to be twofold: stricter SMB hardening and new SID validation introduced in recent cumulative updates like KB5065426. These updates enforce Extended Protection for Authentication and block NTLM fallback in more scenarios, especially when machines share identical or near-identical SIDs from cloned images. That explains why some systems work and others don’t, even with identical policies. Two things worth testing: • Check if the affected machines were imaged without running Sysprep. Duplicate SIDs now break SMB and RDP authentication. If that’s the case, regenerating SIDs or re-imaging with Sysprep is the long-term fix. • If SID uniqueness isn’t the issue, try relaxing NTLM restrictions temporarily. In the registry under HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 , add or confirm NtlmMinClientSec and NtlmMinServerSec values (DWORD) set to 0x20000000 to allow NTLMv2 with 128-bit encryption. Also, check LanmanWorkstation for AllowInsecureGuestAuth if you need to test guest fallback. Do you want me to give you the exact PowerShell commands and registry paths for these changes, plus a way to audit SID duplication across your fleet? Or should we focus on a workaround that doesn’t involve re-imaging? Sam • 30 Reputation points 2025-11-28T16:06:06.2833333+00:00 You've got it, I have some serious questions for the person who told me they used our sysprepped images, but should have checked that myself! Not 100% confirmed as the local teams will need to handle the reimaging, but the SIDs are identical, so that's going to be the problem. Thanks a lot, not sure I'd have got there any time soon. 0 votes You've got it, I have some serious questions for the person who told me they used our sysprepped images, but should have checked that myself! Not 100% confirmed as the local teams will need to handle the reimaging, but the SIDs are identical, so that's going to be the problem. Thanks a lot, not sure I'd have got there any time soon. 5 additional answers Deleted This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information. Comments have been turned off. Learn more This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information. Comments have been turned off. Learn more Deleted This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information. Comments have been turned off. Learn more This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more Mitch • 0 Reputation points 2025-11-28T03:24:18.8633333+00:00 I just found this. I haven't tried it yet and may be risky in a business setting but it may be promising: https://www.asus.com/support/faq/1054736/ 1 comment Show comments for this answer Sam • 30 Reputation points 2025-11-28T08:53:54.11+00:00 Thanks, unfortunately not helping in this situation. If you haven't tried on your system yet it may be worth it, we actually found this solved some initial problems caused by upgrading to Windows 11, but for more recent systems (some but not all 25H2s) it didn't help. 0 votes Sign in to comment Add comment I just found this. I haven't tried it yet and may be risky in a business setting but it may be promising: https://www.asus.com/support/faq/1054736/ Sam • 30 Reputation points 2025-11-28T08:53:54.11+00:00 Thanks, unfortunately not helping in this situation. If you haven't tried on your system yet it may be worth it, we actually found this solved some initial problems caused by upgrading to Windows 11, but for more recent systems (some but not all 25H2s) it didn't help. 0 votes Thanks, unfortunately not helping in this situation. If you haven't tried on your system yet it may be worth it, we actually found this solved some initial problems caused by upgrading to Windows 11, but for more recent systems (some but not all 25H2s) it didn't help. Restee Miranda • 14,100 Reputation points • Independent Advisor 2025-11-27T17:26:11.57+00:00 Hi Sam, Thanks for reaching out to the community. I can see how that would cause a real headache when everything worked fine before. The issue you’re seeing is tied to changes in Windows 11 25H2’s SMB authentication defaults. Microsoft tightened security by disabling older protocols like NTLM fallback in some cases and enforcing stronger credential handling. That’s why even correct credentials fail and you see those 4625 events. First, check if the servers and clients are using the same SMB dialect and confirm that “Network security: LAN Manager authentication level” isn’t set to block NTLM completely. Also, verify that the “Require SMB signing” policy isn’t mismatched between machines. If these look fine, try enabling “Allow insecure guest logons” temporarily to rule out policy conflicts. Are these systems joined to a domain or using local accounts? And do you have any credential manager entries cached that might be interfering? Let me know what you find. Regards, Rez 2 comments Show comments for this answer Mitch • 0 Reputation points 2025-11-28T03:02:51.47+00:00 So, I am having a similar issue but not being in a business environment my problem isn't as pressing. Also, the problem system in my case is Windows Home on a new machine, so I don't have easy access to modify policies. I would like to point out that I have another older computer on 25H2 that doesn't have the problem. It however is part of the Windows 11 Insider Dev program and maybe there is a subtle difference. That system is Windows 11 Pro. 0 votes Sam • 30 Reputation points 2025-11-28T08:50:48.3366667+00:00 Hi Rez, thanks for the response. I've just double checked both of those options and unfortunately no joy. These systems are using local accounts (and I'm testing between administrators) and the credentials manager has been emptied as part of this. In case there is anything I'm missing there's an export of the security policies below. (These are test systems that we've been troubleshooting a while on so aren't reflective of our day to day settings, the aim here is to find the cause of this and then build back up/make the changes we need to securely operate) Local security policies: Policy,Security Setting Accounts: Administrator account status,Disabled Accounts: Block Microsoft accounts,Not Defined Accounts: Guest account status,Disabled Accounts: Limit local account use of blank passwords to console logon only,Disabled Accounts: Rename administrator account,xxxxx Accounts: Rename guest account,xxxxx Audit: Audit the access of global system objects,Disabled Audit: Audit the use of Backup and Restore privilege,Disabled Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings,Not Defined Audit: Shut down system immediately if unable to log security audits,Disabled DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax,Not Defined DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax,Not Defined Devices: Allow undock without having to log on,Enabled Devices: Allowed to format and eject removable media,Not Defined Devices: Prevent users from installing printer drivers,Disabled Devices: Restrict CD-ROM access to locally logged-on user only,Not Defined Devices: Restrict floppy access to locally logged-on user only,Not Defined Domain controller: Allow computer account re-use during domain join,Not Defined Domain controller: Allow server operators to schedule tasks,Not Defined Domain controller: Allow vulnerable Netlogon secure channel connections,Not Defined Domain controller: LDAP server channel binding token requirements,Not Defined Domain controller: LDAP server signing requirements,Not Defined Domain controller: LDAP server signing requirements Enforcement,Not Defined Domain controller: Refuse machine account password changes,Not Defined Domain controller: Refuse setting default machine account password,Not Defined Domain member: Digitally encrypt or sign secure channel data (always),Enabled Domain member: Digitally encrypt secure channel data (when possible),Enabled Domain member: Digitally sign secure channel data (when possible),Enabled Domain member: Disable machine account password changes,Disabled Domain member: Maximum machine account password age,30 days Domain member: Require strong (Windows 2000 or later) session key,Enabled Interactive logon: Display user information when the session is locked,Not Defined Interactive logon: Do not require CTRL+ALT+DEL,Not Defined Interactive logon: Don't display last signed-in,Disabled Interactive logon: Don't display username at sign-in,Not Defined Interactive logon: Machine account lockout threshold,Not Defined Interactive logon: Machine inactivity limit,Not Defined Interactive logon: Message text for users attempting to log on, Interactive logon: Message title for users attempting to log on, Interactive logon: Number of previous logons to cache (in case domain controller is not available),10 logons Interactive logon: Prompt user to change password before expiration,5 days Interactive logon: Require Domain Controller authentication to unlock workstation,Disabled Interactive logon: Require Windows Hello for Business or smart card,Disabled Interactive logon: Smart card removal behavior,No Action Microsoft network client: Digitally sign communications (always),Enabled Microsoft network client: Digitally sign communications (if server agrees),Enabled Microsoft network client: Send unencrypted password to third-party SMB servers,Disabled Microsoft network server: Amount of idle time required before suspending session,15 minutes Microsoft network server: Attempt S4U2Self to obtain claim information,Not Defined Microsoft network server: Digitally sign communications (always),Enabled Microsoft network server: Digitally sign communications (if client agrees),Enabled Microsoft network server: Disconnect clients when logon hours expire,Enabled Microsoft network server: Server SPN target name validation level,Not Defined Network access: Allow anonymous SID/Name translation,Disabled Network access: Do not allow anonymous enumeration of SAM accounts,Enabled Network access: Do not allow anonymous enumeration of SAM accounts and shares,Disabled Network access: Do not allow storage of passwords and credentials for network authentication,Disabled Network access: Let Everyone permissions apply to anonymous users,Disabled Network access: Named Pipes that can be accessed anonymously, Network access: Remotely accessible registry paths,System\CurrentControlSet\Control\ProductOptions,System\CurrentControlSet\Control\Server Applications,Software\Microsoft\Windows NT\CurrentVersion Network access: Remotely accessible registry paths and sub-paths,System\CurrentControlSet\Control\Print\Printers,System\CurrentControlSet\Services\Eventlog,Software\Microsoft\OLAP Server,Software\Microsoft\Windows NT\CurrentVersion\Print,Software\Microsoft\Windows NT\CurrentVersion\Windows,System\CurrentControlSet\Control\ContentIndex,System\CurrentControlSet\Control\Terminal Server,System\CurrentControlSet\Control\Terminal Server\UserConfig,System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration,Software\Microsoft\Windows NT\CurrentVersion\Perflib,System\CurrentControlSet\Services\SysmonLog Network access: Restrict anonymous access to Named Pipes and Shares,Enabled Network access: Restrict clients allowed to make remote calls to SAM,Not Defined Network access: Shares that can be accessed anonymously,Not Defined Network access: Sharing and security model for local accounts,Classic - local users authenticate as themselves Network security: Allow Local System to use computer identity for NTLM,Not Defined Network security: Allow LocalSystem NULL session fallback,Not Defined Network security: Allow PKU2U authentication requests to this computer to use online identities. ,Not Defined Network security: Configure encryption types allowed for Kerberos,Not Defined Network security: Force logoff when logon hours expire,Disabled Network security: LAN Manager authentication level,Send NTLMv2 response only. Refuse LM & NTLM Network security: LDAP client encryption requirements,Negotiate sealing Network security: LDAP client signing requirements,Negotiate signing Network security: Minimum session security for NTLM SSP based (including secure RPC) clients,Require 128-bit encryption Network security: Minimum session security for NTLM SSP based (including secure RPC) servers,Require 128-bit encryption Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication,Not Defined Network security: Restrict NTLM: Add server exceptions in this domain,Not Defined Network security: Restrict NTLM: Audit Incoming NTLM Traffic,Not Defined Network security: Restrict NTLM: Audit NTLM authentication in this domain,Not Defined Network security: Restrict NTLM: Incoming NTLM traffic,Not Defined Network security: Restrict NTLM: NTLM authentication in this domain,Not Defined Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers,Not Defined Recovery console: Allow automatic administrative logon,Disabled Recovery console: Allow floppy copy and access to all drives and all folders,Disabled Shutdown: Allow system to be shut down without having to log on,Enabled Shutdown: Clear virtual memory pagefile,Disabled System cryptography: Force strong key protection for user keys stored on the computer,Not Defined System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing,Disabled System objects: Require case insensitivity for non-Windows subsystems,Enabled System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links),Enabled System settings: Optional subsystems, System settings: Use Certificate Rules on Windows Executables for Software Restriction Policies,Disabled User Account Control: Admin Approval Mode for the Built-in Administrator account,Not Defined User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop,Disabled User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode,Elevate without prompting User Account Control: Behavior of the elevation prompt for administrators running with Administrator protection,Prompt for credentials on the secure desktop User Account Control: Behavior of the elevation prompt for standard users,Prompt for credentials User Account Control: Configure type of Admin Approval Mode,Legacy Admin Approval Mode (Default) User Account Control: Detect application installations and prompt for elevation,Enabled User Account Control: Only elevate executables that are signed and validated,Disabled User Account Control: Only elevate UIAccess applications that are installed in secure locations,Enabled User Account Control: Run all administrators in Admin Approval Mode,Enabled User Account Control: Switch to the secure desktop when prompting for elevation,Disabled User Account Control: Virtualize file and registry write failures to per-user locations,Enabled Group policies LanmanWorkstation Setting,State,Comment Alternative Port Mappings,Not configured,No Audit insecure guest logon,Not configured,No Audit server does not support encryption,Not configured,No Audit server does not support signing,Not configured,No Block NTLM (LM, NTLM, NTLMv2),Not configured,No Block NTLM Server Exception List,Not configured,No Cipher suite order,Not configured,No Disable SMB compression,Not configured,No Disabled SMB over QUIC Server Exception List,Not configured,No Enable Alternative Ports,Not configured,No Use SMB compression by default,Not configured,No Handle Caching on Continuous Availability Shares,Not configured,No Enable insecure guest logons,Enabled,Yes Enable remote mailslots,Not configured,No Offline Files Availability on Continuous Availability Shares,Not configured,No Enable SMB over QUIC,Not configured,No Mandate the maximum version of SMB,Not configured,No Mandate the minimum version of SMB,Not configured,No Require Encryption,Not configured,No LanmanServer Setting,State,Comment Audit client does not support encryption,Not configured,No Audit client does not support signing,Not configured,No Audit SMB client SPN support,Not configured,No Audit insecure guest logon,Not configured,No Set authentication rate limiter delay (milliseconds),Not configured,No Cipher suite order,Not configured,No Disable SMB compression,Not configured,No Enable authentication rate limiter,Not configured,No Request traffic compression for all shares,Not configured,No Enable remote mailslots,Not configured,No Enable SMB over QUIC,Not configured,No Hash Publication for BranchCache,Not configured,No Hash Version support for BranchCache,Not configured,No Honor cipher suite order,Not configured,No Mandate the maximum version of SMB,Not configured,No Mandate the minimum version of SMB,Not configured,No 0 votes Sign in to comment Add comment Thanks for reaching out to the community. I can see how that would cause a real headache when everything worked fine before. The issue you’re seeing is tied to changes in Windows 11 25H2’s SMB authentication defaults. Microsoft tightened security by disabling older protocols like NTLM fallback in some cases and enforcing stronger credential handling. That’s why even correct credentials fail and you see those 4625 events. First, check if the servers and clients are using the same SMB dialect and confirm that “Network security: LAN Manager authentication level” isn’t set to block NTLM completely. Also, verify that the “Require SMB signing” policy isn’t mismatched between machines. If these look fine, try enabling “Allow insecure guest logons” temporarily to rule out policy conflicts. Are these systems joined to a domain or using local accounts? And do you have any credential manager entries cached that might be interfering? Let me know what you find. Mitch • 0 Reputation points 2025-11-28T03:02:51.47+00:00 So, I am having a similar issue but not being in a business environment my problem isn't as pressing. Also, the problem system in my case is Windows Home on a new machine, so I don't have easy access to modify policies. I would like to point out that I have another older computer on 25H2 that doesn't have the problem. It however is part of the Windows 11 Insider Dev program and maybe there is a subtle difference. That system is Windows 11 Pro. 0 votes So, I am having a similar issue but not being in a business environment my problem isn't as pressing. Also, the problem system in my case is Windows Home on a new machine, so I don't have easy access to modify policies. I would like to point out that I have another older computer on 25H2 that doesn't have the problem. It however is part of the Windows 11 Insider Dev program and maybe there is a subtle difference. That system is Windows 11 Pro. Sam • 30 Reputation points 2025-11-28T08:50:48.3366667+00:00 Hi Rez, thanks for the response. I've just double checked both of those options and unfortunately no joy. These systems are using local accounts (and I'm testing between administrators) and the credentials manager has been emptied as part of this. In case there is anything I'm missing there's an export of the security policies below. (These are test systems that we've been troubleshooting a while on so aren't reflective of our day to day settings, the aim here is to find the cause of this and then build back up/make the changes we need to securely operate) Local security policies: Policy,Security Setting Accounts: Administrator account status,Disabled Accounts: Block Microsoft accounts,Not Defined Accounts: Guest account status,Disabled Accounts: Limit local account use of blank passwords to console logon only,Disabled Accounts: Rename administrator account,xxxxx Accounts: Rename guest account,xxxxx Audit: Audit the access of global system objects,Disabled Audit: Audit the use of Backup and Restore privilege,Disabled Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings,Not Defined Audit: Shut down system immediately if unable to log security audits,Disabled DCOM: Machine Access Restrictions in Security Descriptor Definition Language (SDDL) syntax,Not Defined DCOM: Machine Launch Restrictions in Security Descriptor Definition Language (SDDL) syntax,Not Defined Devices: Allow undock without having to log on,Enabled Devices: Allowed to format and eject removable media,Not Defined Devices: Prevent users from installing printer drivers,Disabled Devices: Restrict CD-ROM access to locally logged-on user only,Not Defined Devices: Restrict floppy access to locally logged-on user only,Not Defined Domain controller: Allow computer account re-use during domain join,Not Defined Domain controller: Allow server operators to schedule tasks,Not Defined Domain controller: Allow vulnerable Netlogon secure channel connections,Not Defined Domain controller: LDAP server channel binding token requirements,Not Defined Domain controller: LDAP server signing requirements,Not Defined Domain controller: LDAP server signing requirements Enforcement,Not Defined Domain controller: Refuse machine account password changes,Not Defined Domain controller: Refuse setting default machine account password,Not Defined Domain member: Digitally encrypt or sign secure channel data (always),Enabled Domain member: Digitally encrypt secure channel data (when possible),Enabled Domain member: Digitally sign secure channel data (when possible),Enabled Domain member: Disable machine account password changes,Disabled Domain member: Maximum machine account password age,30 days Domain member: Require strong (Windows 2000 or later) session key,Enabled Interactive logon: Display user information when the session is locked,Not Defined Interactive logon: Do not require CTRL+ALT+DEL,Not Defined Interactive logon: Don't display last signed-in,Disabled Interactive logon: Don't display username at sign-in,Not Defined Interactive logon: Machine account lockout threshold,Not Defined Interactive logon: Machine inactivity limit,Not Defined Interactive logon: Message text for users attempting to log on, Interactive logon: Message title for users attempting to log on, Interactive logon: Number of previous logons to cache (in case domain controller is not available),10 logons Interactive logon: Prompt user to change password before expiration,5 days Interactive logon: Require Domain Controller authentication to unlock workstation,Disabled Interactive logon: Require Windows Hello for Business or smart card,Disabled Interactive logon: Smart card removal behavior,No Action Microsoft network client: Digitally sign communications (always),Enabled Microsoft network client: Digitally sign communications (if server agrees),Enabled Microsoft network client: Send unencrypted password to third-party SMB servers,Disabled Microsoft network server: Amount of idle time required before suspending session,15 minutes Microsoft network server: Attempt S4U2Self to obtain claim information,Not Defined Microsoft network server: Digitally sign communications (always),Enabled Microsoft network server: Digitally sign communications (if client agrees),Enabled Microsoft network server: Disconnect clients when logon hours expire,Enabled Microsoft network server: Server SPN target name validation level,Not Defined Network access: Allow anonymous SID/Name translation,Disabled Network access: Do not allow anonymous enumeration of SAM accounts,Enabled Network access: Do not allow anonymous enumeration of SAM accounts and shares,Disabled Network access: Do not allow storage of passwords and credentials for network authentication,Disabled Network access: Let Everyone permissions apply to anonymous users,Disabled Network access: Named Pipes that can be accessed anonymously, Network access: Remotely accessible registry paths,System\CurrentControlSet\Control\ProductOptions,System\CurrentControlSet\Control\Server Applications,Software\Microsoft\Windows NT\CurrentVersion Network access: Remotely accessible registry paths and sub-paths,System\CurrentControlSet\Control\Print\Printers,System\CurrentControlSet\Services\Eventlog,Software\Microsoft\OLAP Server,Software\Microsoft\Windows NT\CurrentVersion\Print,Software\Microsoft\Windows NT\CurrentVersion\Windows,System\CurrentControlSet\Control\ContentIndex,System\CurrentControlSet\Control\Terminal Server,System\CurrentControlSet\Control\Terminal Server\UserConfig,System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration,Software\Microsoft\Windows NT\CurrentVersion\Perflib,System\CurrentControlSet\Services\SysmonLog Network access: Restrict anonymous access to Named Pipes and Shares,Enabled Network access: Restrict clients allowed to make remote calls to SAM,Not Defined Network access: Shares that can be accessed anonymously,Not Defined Network access: Sharing and security model for local accounts,Classic - local users authenticate as themselves Network security: Allow Local System to use computer identity for NTLM,Not Defined Network security: Allow LocalSystem NULL session fallback,Not Defined Network security: Allow PKU2U authentication requests to this computer to use online identities. ,Not Defined Network security: Configure encryption types allowed for Kerberos,Not Defined Network security: Force logoff when logon hours expire,Disabled Network security: LAN Manager authentication level,Send NTLMv2 response only. Refuse LM & NTLM Network security: LDAP client encryption requirements,Negotiate sealing Network security: LDAP client signing requirements,Negotiate signing Network security: Minimum session security for NTLM SSP based (including secure RPC) clients,Require 128-bit encryption Network security: Minimum session security for NTLM SSP based (including secure RPC) servers,Require 128-bit encryption Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication,Not Defined Network security: Restrict NTLM: Add server exceptions in this domain,Not Defined Network security: Restrict NTLM: Audit Incoming NTLM Traffic,Not Defined Network security: Restrict NTLM: Audit NTLM authentication in this domain,Not Defined Network security: Restrict NTLM: Incoming NTLM traffic,Not Defined Network security: Restrict NTLM: NTLM authentication in this domain,Not Defined Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers,Not Defined Recovery console: Allow automatic administrative logon,Disabled Recovery console: Allow floppy copy and access to all drives and all folders,Disabled Shutdown: Allow system to be shut down without having to log on,Enabled Shutdown: Clear virtual memory pagefile,Disabled System cryptography: Force strong key protection for user keys stored on the computer,Not Defined System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing,Disabled System objects: Require case insensitivity for non-Windows subsystems,Enabled System objects: Strengthen default permissions of internal system objects (e.g. Symbolic Links),Enabled System settings: Optional subsystems, System settings: Use Certificate Rules on Windows Executables for Software Restriction Policies,Disabled User Account Control: Admin Approval Mode for the Built-in Administrator account,Not Defined User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop,Disabled User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode,Elevate without prompting User Account Control: Behavior of the elevation prompt for administrators running with Administrator protection,Prompt for credentials on the secure desktop User Account Control: Behavior of the elevation prompt for standard users,Prompt for credentials User Account Control: Configure type of Admin Approval Mode,Legacy Admin Approval Mode (Default) User Account Control: Detect application installations and prompt for elevation,Enabled User Account Control: Only elevate executables that are signed and validated,Disabled User Account Control: Only elevate UIAccess applications that are installed in secure locations,Enabled User Account Control: Run all administrators in Admin Approval Mode,Enabled User Account Control: Switch to the secure desktop when prompting for elevation,Disabled User Account Control: Virtualize file and registry write failures to per-user locations,Enabled Group policies LanmanWorkstation Setting,State,Comment Alternative Port Mappings,Not configured,No Audit insecure guest logon,Not configured,No Audit server does not support encryption,Not configured,No Audit server does not support signing,Not configured,No Block NTLM (LM, NTLM, NTLMv2),Not configured,No Block NTLM Server Exception List,Not configured,No Cipher suite order,Not configured,No Disable SMB compression,Not configured,No Disabled SMB over QUIC Server Exception List,Not configured,No Enable Alternative Ports,Not configured,No Use SMB compression by default,Not configured,No Handle Caching on Continuous Availability Shares,Not configured,No Enable insecure guest logons,Enabled,Yes Enable remote mailslots,Not configured,No Offline Files Availability on Continuous Availability Shares,Not configured,No Enable SMB over QUIC,Not configured,No Mandate the maximum version of SMB,Not configured,No Mandate the minimum version of SMB,Not configured,No Require Encryption,Not configured,No LanmanServer Setting,State,Comment Audit client does not support encryption,Not configured,No Audit client does not support signing,Not configured,No Audit SMB client SPN support,Not configured,No Audit insecure guest logon,Not configured,No Set authentication rate limiter delay (milliseconds),Not configured,No Cipher suite order,Not configured,No Disable SMB compression,Not configured,No Enable authentication rate limiter,Not configured,No Request traffic compression for all shares,Not configured,No Enable remote mailslots,Not configured,No Enable SMB over QUIC,Not configured,No Hash Publication for BranchCache,Not configured,No Hash Version support for BranchCache,Not configured,No Honor cipher suite order,Not configured,No Mandate the maximum version of SMB,Not configured,No Mandate the minimum version of SMB,Not configured,No 0 votes Hi Rez, thanks for the response. I've just double checked both of those options and unfortunately no joy. These systems are using local accounts (and I'm testing between administrators) and the credentials manager has been emptied as part of this. In case there is anything I'm missing there's an export of the security policies below. (These are test systems that we've been troubleshooting a while on so aren't reflective of our day to day settings, the aim here is to find the cause of this and then build back up/make the changes we need to securely operate) Local security policies: