I have a couple file shares on a Server 2016 build, the users are able to access the files no problem, but when reviewing the event viewer I found this error which I am not sure what it is relating too.
Log Name: Microsoft-Windows-SMBServer/Security
Source: Microsoft-Windows-SMBServer
Date: 4/17/2019 12:00:13 PM
Event ID: 1006
Task Category: (1006)
Level: Error
Keywords: Audit Failure,(8)
User: SYSTEM
Computer:
Description:
The share denied access to the client.
Client Name: \\192.168.1.32
Client Address: 192.168.1.32:51903
User Name: Domain\Computer$
Session ID: 0x1700078000061
Share Name: \\*\Folder
Share Path: \??\C:\Folder
Status: {Access Denied}
A process has requested access to an object, but has not been granted those access rights. (0xC0000022)
Mapped Access: 0x80
Granted Access: 0x0
Security Descriptor: 0x01000480AC000000BC0000000000000014000000020098000400000000002400FF011F000105000000000005150000001090F1A31FB3486114BADC1A5C08000000002400FF011F000105000000000005150000001090F1A31FB3486114BADC1A5E08000000002400FF011F000105000000000005150000001090F1A31FB3486114BADC1A9108000000002400FF011F00010500000000000515000000C714F62B5E19EFD99B2E1495F401000001020000000000052000000020020000010500000000000515000000C714F62B5E19EFD99B2E149501020000
Guidance:
You should expect access denied errors when a principal accesses a share without the necessary permissions. Usually, this indicates that the principal does not have direct security permissions or lacks membership in a group that has direct access permissions.
To determine and correct the permissions on the specified share, an administrator can use the Security tab in File Explorer Properties dialog, the SMBSHARE Windows PowerShell module, or the NET SHARE command. You can also use the Effective Access tab in File
Explorer to help diagnose the issue.
Applications may generate access denied errors if they attempt to open files in a writable mode first, and then reopen the files in a read-only mode. In this case, no user action is required.
If access to the share is denied and this event is not logged, you can examine the file and folder NTFS/REFS permissions.
This error does not indicate a problem with authentication, only authorization.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-SMBServer" Guid="{Example}" />
<EventID>1006</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>1006</Task>
<Opcode>0</Opcode>
<Keywords>0x810000000000008</Keywords>
<TimeCreated SystemTime="2019-04-17T17:00:13.476209300Z" />
<EventRecordID>79434</EventRecordID>
<Correlation />
<Execution ProcessID="4" ThreadID="12116" />
<Channel>Microsoft-Windows-SMBServer/Security</Channel>
<Computer>Computer</Computer>
<Security UserID="S-1-5-18" />
</System>
<UserData>
<EventData xmlns="Smb2Namespace">
<ShareNameLength>7</ShareNameLength>
<ShareName>\\*\BCC</ShareName>
<SharePathLength>10</SharePathLength>
<SharePath>\??\C:\BCC</SharePath>
<ClientAddressLength>128</ClientAddressLength>
<ClientAddress>0200CABFC0A8012000000000000000000000FFFFC0A801200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000</ClientAddress>
<UserNameLength>16</UserNameLength>
<UserName>Domain\Computer$</UserName>
<ClientNameLength>14</ClientNameLength>
<ClientName>\\192.168.1.32</ClientName>
<MappedAccess>0x80</MappedAccess>
<GrantedAccess>0x0</GrantedAccess>
<ShareSecurityDescriptorLength>216</ShareSecurityDescriptorLength>
<ShareSecurityDescriptor>01000480AC000000BC0000000000000014000000020098000400000000002400FF011F000105000000000005150000001090F1A31FB3486114BADC1A5C08000000002400FF011F000105000000000005150000001090F1A31FB3486114BADC1A5E08000000002400FF011F000105000000000005150000001090F1A31FB3486114BADC1A9108000000002400FF011F00010500000000000515000000C714F62B5E19EFD99B2E1495F401000001020000000000052000000020020000010500000000000515000000C714F62B5E19EFD99B2E149501020000</ShareSecurityDescriptor>
<Status>0xc0000022</Status>
<TranslatedStatus>0xc0000022</TranslatedStatus>
<SessionID>0x1700078000061</SessionID>
</EventData>
</UserData>
</Event>