Reviewed October 21, 2026. Commands are examples for an authorized, isolated lab; no target results are asserted here.
A negotiation error is not an instruction to enable SMB1. First confirm the target, port, installed client and exact failing stage. An old lab image may need legacy compatibility, but the age of a machine and an ACCESS_DENIED message do not establish a dialect mismatch.
Which operation failed?
| Observed message or event | Start here |
|---|---|
| Timeout, refused connection or name resolution failure | Verify the address, lab network, selected port and name resolution. |
| Protocol negotiation failed | Inspect the offered/allowed dialects and the accompanying error. Confirm a server response. |
| Session setup failed | Inspect the requested identity and authentication policy. Negotiation may already have succeeded. |
| Tree connect failed | Check the published share name and share connection policy. |
| Connected, but ls failed | Record the directory operation and its permission or request error. |
Keep the full line containing the error, not just its status code. A command can also print a share table successfully and then fail a separate legacy workgroup-browsing step. That final warning does not automatically invalidate the table or prove that file access failed.
Capture an unchanged baseline
These examples run on your lab client. Replace every uppercase placeholder with a verified value. Use the port observed for this target, including 139 if that is the available lab transport.
smbclient -V
smbclient --help
smbclient '//TARGET_IP/SHARE_NAME' -p SMB_PORT -U 'WORKGROUP/labuser' -d 3Use only an assigned account and a known share in the exercise. Let the password prompt handle the secret. Record the client version, time, requested identity, port and first failed stage. If the exercise is a blank-credential test instead, preserve that identity consistently in both runs; do not introduce a named account while also changing the protocol.
Check the installed manual and effective configuration for local overrides. Upstream defaults do not prove the settings of your Kali package. -V reports the local client version; it is not the remote server version. Review debug output before sharing it because it can contain usernames, paths and environment details.
Compare one command only when the evidence supports it
A bounded comparison is appropriate when you have confirmed an isolated, authorized legacy target and credible evidence that its SMB service requires SMB1, such as the lab specification or administrator-controlled server configuration. Keep the target, account, share and port unchanged.
# Legacy-lab diagnostic only: allow NT1 as the minimum for this invocation
smbclient '//TARGET_IP/SHARE_NAME' -p SMB_PORT -U 'WORKGROUP/labuser' --option='client min protocol=NT1' -d 3This lowers the minimum for that invocation; it still permits higher dialects within the client’s maximum. It does not prove that NT1 was selected. If the specific comparison requires an NT1-only range, the installed client supports it, and the same authorization applies:
# Restrict BOTH ends of this invocation's range to NT1
smbclient '//TARGET_IP/SHARE_NAME' -p SMB_PORT -U 'WORKGROUP/labuser' --option='client min protocol=NT1' -m NT1 -d 3-m NT1 sets a maximum. It does not, by itself, lower a minimum that excludes NT1. Adding it restricts the range; it does not widen it. Consult the client minimum protocol documentation and installed help before using either example.
Interpret a changed result narrowly
If negotiation now succeeds but session setup is rejected, you reached a different failure stage. You have not demonstrated working credentials or file access. If the connection succeeds, record the actual negotiated dialect and repeat only the intended read-only operation. A successful second run is evidence for that run; it does not isolate every possible cause when the server or network changed between attempts.
Do not turn these examples into permanent global settings, disable signing or encryption, or bundle authentication downgrades into the comparison. Server-side ntlm auth is not a general client negotiation fix. If an old authentication mechanism is also incompatible, document that as a separate limitation rather than silently weakening more settings.
Keep the next step tied to the failed stage
Use the SMB operation record to preserve baseline and comparison results. Once negotiation works, continue with tree-connect diagnosis or directory-access diagnosis as appropriate. This guide does not require changing the host’s persistent security policy.
Primary references: smbclient, smb.conf, and Microsoft’s Negotiate, Session Setup and Tree Connect troubleshooting.