Access denied when connecting to SMB share

After I tested this with a couple other servers in the enterprise -- some that were AD controllers and others that weren' t -- a pattern quickly developed: if it' s an AD controller, you don' t have to enter the domain in front of the username. If it' s not a controller, you have to add the domain. If anyone knows why this is, I am interested. Perhaps I am just forgetting something basic about the way authentication works.

Hi cucciajm, I looked into this issue about a month back when I was setting up SMBs to use SSO and came to the same conclusion. If you create an SMB share on a DC, no domain is required to be specified (e.g. You don' t need to use Alternate SSO credentials that need to be setup by each of your users manually if you' re trying to map My Documents). The reason why you need to specify the domain is during the authentication phase the FortiGate device by default sends NT\username. NT\username is a " local only" lookup, and as your DC contains the users for your forest/domain it is able to authenticate. When you have the SMB share on a non-DC server it does not have the AD user accounts stored on it so it does not work. If you create a local user account on the server where the SMB is stored though, you can access it as normal, but this is pointless in a domain environment. The only way to get this fixed is if Fortinet implements a default domain parameter that can be enabled and disabled on a per bookmark basis (for those with multiple domains). I' ve been meaning to contact someone about it but I have not gotten around to it yet. I hope this sheds some light on the issue for you.