Return
-
Title
Could not connect to any server: NT_STATUS_CONNECTION_REFUSED.Group policies not being applied when joined to a Windows 2012 R2 Server with SMB1 disabled. How to enable SMB2. -
Description
Could not connect to any server: NT_STATUS_CONNECTION_REFUSEDGroup Polices are not being applied to systems that are joined to Microsoft Windows 2012 R2 Servers that have SMB1 disabled. Authentications are working as expected.How to enable SMB2 on the QAS client.
-
Cause
In QAS 4.1.3 and up SMB2 used by default. Windows Server 2012 uses SMB2 by default.
-
Resolution
RESOLUTION 1:
QAS 4.1.3 and higher uses SMB2 to download group policies. SMB2 is enabled on Windows Server 2012 by default.
1 - Upgrade to QAS version higher than 4.1.3. Download the latest maintenance release by going to
https://support.oneidentity.com/authentication-services/download-new-releases
The upgrade will run the following command to apply the the group policies to the client:
/opt/quest/bin/vgptool apply
2 - Run the following command to review the Result set of Policy for the client:/opt/quest/bin/vgptool rsop -
Change Request
386251 -
Additional Information
QAS versions before 4.1.0.22739 only support SMB1 and not SMB2 in order for Vintela Group Policy (VGP) to work. As of QAS 4.1.0.22739 SMB2 and SMB3 are also supported although they aren't enabled by default. On QAS version 4.1.0.22739 to 4.1.2.x run the following command to set the /etc/opt/quest/vas/vas.conf setting to enable SMB2: /opt/quest/bin/vastool configure vas libvas smb-dialect-range 2.1-3