[Samba] Printserver after latest MS updates

Fri Oct 22 09:13:07 UTC 2021

> Hello Samba-Group,
>
> I also ran into PrintNightmare issues today after applying the Update 2021-10.
> My Client PC is running W10 LTSC 2019.
> My Samba fileserver is running on debian buster using samba 4.9.5 as an active directory member.
>
> If I log in with an AD account on the client. I can connect printers and manage them as usual with printmanagement connecting to the server.
> But if i log in with an local client account and connect to the server with entering  user/password shares are working but printers can not be connected and printmanagement does not list printers or
> drivers.
>
> I found the following interesting post https://www.bleepingcomputer.com/forums/t/759880/kb5006670-network-printer-problems-again-this-month/page-8#entry5263758
>
> -------------------------------------------------------------------------------------------
> After Sniffing around in Wireshark seems like this newer spooler is doing two things different:
>  
> 1) On the DCERPC call it has added NTLMSSP_NEGOTIATE and Attempts to Authenticate NTLMSSP_CHALLANGE
> 2) On the SPOOLSS call the Name of the Printer is now encrypted
>  
> Failing (Oct DLL's) 0x000006e4 RPC_S_CANNOT_SUPPORT 
> Attached File <https://www.bleepingcomputer.com/forums/index.php?app=core&module=attach&section=attach&attach_id=235499>  *SnifferNg.png*
> <https://www.bleepingcomputer.com/forums/index.php?app=core&module=attach&section=attach&attach_id=235499>   *135.19KB*   2 downloads
>  
> Working (Sept DLL's)
> Attached File <https://www.bleepingcomputer.com/forums/index.php?app=core&module=attach&section=attach&attach_id=235498>  *SnifferOK.png*
> <https://www.bleepingcomputer.com/forums/index.php?app=core&module=attach&section=attach&attach_id=235498>   *137.39KB*   0 downloads
>  
> Above are to a 2003 server from Win10
>  
> I think this is a problem with older server's not knowing how to handle encryption and the spooler not falling back to unencrypted communications
> https://docs.microsoft.com/en-us/windows/win32/api/rpcasync/nf-rpcasync-rpcbindingbind <https://docs.microsoft.com/en-us/windows/win32/api/rpcasync/nf-rpcasync-rpcbindingbind>
>  
>  
> HTH,
> Mike Pisano
> -------------------------------------------------------------------------------------------
>
> On bleepingcomputer they replace the files localspl.dll win32spl.dll and spoolsv.exe in c:\windows\system32 with version from Update 2021-09. This temporary workaround works for me. Have not yet
> figured out an other way to get printing working with local accounts against the samba server.
>
>
> Good Night,
> Achim Gottinger
Did a bit more testing logged on with an local pc admin account.

Fileserver 1: Debian buster 4.9.5 smb.conf

[global]
        netbios name = FS-1
        realm = DOMAIN.LOCAL
        workgroup = DOMAIN

        logging = syslog
        log level = 0 auth_audit:4

        usershare path =

        bind interfaces only = yes
        interfaces = 192.168.100.157 127.0.0.1

        dedicated keytab file = /etc/krb5.keytab
        kerberos method = secrets and keytab

        security = ADS

        idmap config * : backend = tdb
        idmap config * : range = 3000000-4000000

        idmap config DOMAIN : backend = ad
        idmap config DOMAIN : schema_mode = rfc2307
        idmap config DOMAIN : range = 500-2999999

        winbind use default domain = yes
        winbind enum users = yes
        winbind enum groups = yes

        load printers = yes
        min protocol = SMB2

[printers]
        comment = All Printers
        path = /var/spool/samba
        browseable = Yes
        read only = No
        printable = Yes

[print$]
        comment = Point and Print Printer Drivers
        path = /var/lib/samba/printers
        read only = No

If I connect to the FQDN (same with just hostname part) name and try to connect a printer I get an error message saying the printer can not be connectet and the name should be checked.
Sometimes I also get an error message dialog with error number 0x00000709 before.

Fileserver 2: Debian bullseye 4.13.5 smb.conf

[global]
        netbios name = FS-2
        realm = DOMAIN2.LOCAL
        workgroup = DOMAINNAME

        logging = syslog
        log level = 0

        usershare path =

        bind interfaces only = yes
        interfaces = 192.168.215.102 127.0.0.1

        tls enabled = true
        tls keyfile  = /etc/samba/tls/fs-2.domain2.local.key
        tls certfile = /etc/samba/tls/fs-2.domain2.local.crt

        security = ADS

        idmap config * : backend = tdb
        idmap config * : range = 3000000-4000000

        idmap config DOMAINNAME: backend = ad
        idmap config DOMAINNAME: schema_mode = rfc2307
        idmap config DOMAINNAME: range = 500-2999999

        winbind use default domain = yes
        winbind enum users = yes
        winbind enum groups = yes

        printing = cups
        spoolss: architecture = Windows x64
        rpc_server:spoolss = external
        rpc_daemon:spoolssd = fork

[printers]
        comment = All Printers
        path = /var/spool/samba
        browseable = Yes
        read only = No
        printable = Yes

[print$]
        comment = Point and Print Printer Drivers
        path = /var/lib/samba/printers
        read only = No

If i connect to a printer an dialog asking for user/pass pops up. If I enter the same credentials I used to connect to the server an dialog appears saying the credentials i entered are in conflict
with the currently used credentials. I accept to use the new credentials and an dialog appears saying the credentials do not have sufficient rights to access the printer.

On the client side I tried to enable/disable smb1 ntlm2 outgoing traffic, gpo's for printer install rights with no success.
On the samba side "min protocol" and "ntlm auth" also no success.

Captured traffic during printer connection with local vs domain account and with 2021-09 vs 2021-10 Update against FS-1 (4.9.5).

Local Account 2021-09 Update (working)

76    23:24:22,744642    192.168.100.157    192.168.100.116    SMB2    210    Create Response File: spoolss
77    23:24:22,744729    192.168.100.116    192.168.100.157    DCERPC    330    Bind: call_id: 2, Fragment: Single, 3 context items: SPOOLSS V1.0 (32bit NDR), SPOOLSS V1.0 (64bit NDR), SPOOLSS V1.0
(6cb71c2c-9812-4540-0300-000000000000)
78    23:24:22,744740    192.168.100.116    192.168.100.157    DCERPC    330    Bind: call_id: 2, Fragment: Single, 3 context items: SPOOLSS V1.0 (32bit NDR), SPOOLSS V1.0 (64bit NDR), SPOOLSS V1.0
(6cb71c2c-9812-4540-0300-000000000000)
79    23:24:22,744751    192.168.100.116    192.168.100.157    SMB2    192    Create Request File: spoolss
81    23:24:22,745612    192.168.100.157    192.168.100.116    SMB2    138    Write Response
82    23:24:22,745612    192.168.100.157    192.168.100.116    SMB2    138    Write Response
84    23:24:22,746108    192.168.100.157    192.168.100.116    SMB2    210    Create Response File: spoolss
85    23:24:22,746152    192.168.100.116    192.168.100.157    SMB2    171    Read Request Len:1024 Off:0 File: spoolss
86    23:24:22,746161    192.168.100.116    192.168.100.157    SMB2    171    Read Request Len:1024 Off:0 File: spoolss
87    23:24:22,746174    192.168.100.116    192.168.100.157    DCERPC    330    Bind: call_id: 2, Fragment: Single, 3 context items: SPOOLSS V1.0 (32bit NDR), SPOOLSS V1.0 (64bit NDR), SPOOLSS V1.0
(6cb71c2c-9812-4540-0300-000000000000)
88    23:24:22,746675    192.168.100.157    192.168.100.116    DCERPC    206    Bind_ack: call_id: 2, Fragment: Single, max_xmit: 4280 max_recv: 4280, 1 results: Acceptance
89    23:24:22,746739    192.168.100.116    192.168.100.157    SPOOLSS    454    OpenPrinterEx request, \\FS-1\Printer

Local Account 2021-10 Update (failing)

54    23:19:36,466764    192.168.100.157    192.168.100.116    SMB2    210    Create Response File: spoolss
55    23:19:36,466823    192.168.100.116    192.168.100.157    DCERPC    397    Bind: call_id: 2, Fragment: Single, 3 context items: SPOOLSS V1.0 (32bit NDR), SPOOLSS V1.0 (64bit NDR), SPOOLSS V1.0
(6cb71c2c-9812-4540-0300-000000000000), NTLMSSP_NEGOTIATE
56    23:19:36,467194    192.168.100.116    192.168.100.157    DCERPC    397    Bind: call_id: 2, Fragment: Single, 3 context items: SPOOLSS V1.0 (32bit NDR), SPOOLSS V1.0 (64bit NDR), SPOOLSS V1.0
(6cb71c2c-9812-4540-0300-000000000000), NTLMSSP_NEGOTIATE
57    23:19:36,467204    192.168.100.116    192.168.100.157    DCERPC    397    Bind: call_id: 2, Fragment: Single, 3 context items: SPOOLSS V1.0 (32bit NDR), SPOOLSS V1.0 (64bit NDR), SPOOLSS V1.0
(6cb71c2c-9812-4540-0300-000000000000), NTLMSSP_NEGOTIATE
58    23:19:36,467285    192.168.100.157    192.168.100.116    SMB2    138    Write Response
59    23:19:36,467337    192.168.100.116    192.168.100.157    SMB2    171    Read Request Len:1024 Off:0 File: spoolss
61    23:19:36,468030    192.168.100.157    192.168.100.116    SMB2    138    Write Response
62    23:19:36,468074    192.168.100.116    192.168.100.157    SMB2    171    Read Request Len:1024 Off:0 File: spoolss
63    23:19:36,468223    192.168.100.157    192.168.100.116    SMB2    138    Write Response
64    23:19:36,468265    192.168.100.116    192.168.100.157    SMB2    171    Read Request Len:1024 Off:0 File: spoolss
65    23:19:36,469120    192.168.100.116    192.168.100.157    SMB2    192    Create Request File: spoolss
66    23:19:36,469877    192.168.100.157    192.168.100.116    SMB2    131    Read Response, Error: STATUS_PENDING
67    23:19:36,469877    192.168.100.157    192.168.100.116    DCERPC    404    Bind_ack: call_id: 2, Fragment: Single, max_xmit: 4280 max_recv: 4280, 1 results: Acceptance, NTLMSSP_CHALLENGE
68    23:19:36,469877    192.168.100.157    192.168.100.116    DCERPC    404    Bind_ack: call_id: 2, Fragment: Single, max_xmit: 4280 max_recv: 4280, 1 results: Acceptance, NTLMSSP_CHALLENGE
70    23:19:36,469937    192.168.100.157    192.168.100.116    SMB2    210    Create Response File: spoolss
72    23:19:36,470031    192.168.100.157    192.168.100.116    DCERPC    404    Bind_ack: call_id: 2, Fragment: Single, max_xmit: 4280 max_recv: 4280, 1 results: Acceptance, NTLMSSP_CHALLENGE
73    23:19:36,470221    192.168.100.116    192.168.100.157    DCERPC    397    Bind: call_id: 2, Fragment: Single, 3 context items: SPOOLSS V1.0 (32bit NDR), SPOOLSS V1.0 (64bit NDR), SPOOLSS V1.0
(6cb71c2c-9812-4540-0300-000000000000), NTLMSSP_NEGOTIATE
74    23:19:36,470348    192.168.100.116    192.168.100.157    DCERPC    696    AUTH3: call_id: 2, Fragment: Single, NTLMSSP_AUTH, User: Client\Administrator
75    23:19:36,470385    192.168.100.116    192.168.100.157    DCERPC    696    AUTH3: call_id: 2, Fragment: Single, NTLMSSP_AUTH, User: Client\Administrator
76    23:19:36,470405    192.168.100.116    192.168.100.157    DCERPC    696    AUTH3: call_id: 2, Fragment: Single, NTLMSSP_AUTH, User: Client\Administrator
78    23:19:36,470631    192.168.100.157    192.168.100.116    SMB2    138    Write Response
80    23:19:36,470675    192.168.100.116    192.168.100.157    SMB2    171    Read Request Len:1024 Off:0 File: spoolss
81    23:19:36,470771    192.168.100.157    192.168.100.116    SMB2    138    Write Response
82    23:19:36,470821    192.168.100.116    192.168.100.157    SPOOLSS    530    OpenPrinterEx request
83    23:19:36,471478    192.168.100.157    192.168.100.116    SMB2    138    Write Response
84    23:19:36,471520    192.168.100.116    192.168.100.157    SPOOLSS    530    OpenPrinterEx request
85    23:19:36,477317    192.168.100.157    192.168.100.116    SMB2    138    Write Response
86    23:19:36,477365    192.168.100.116    192.168.100.157    SPOOLSS    530    OpenPrinterEx request
87    23:19:36,486416    192.168.100.157    192.168.100.116    SMB2    131    Read Response, Error: STATUS_PENDING
88    23:19:36,486830    192.168.100.157    192.168.100.116    SMB2    558    Ioctl Response, Error: STATUS_CONNECTION_DISCONNECTED

AD Account 2021-10 Update (working)

25    23:45:47,397096    192.168.100.157    192.168.100.116    SMB2    210    Create Response File: spoolss
26    23:45:47,397153    192.168.100.116    192.168.100.157    SMB2    162    GetInfo Request FILE_INFO/SMB2_FILE_STANDARD_INFO File: spoolss
27    23:45:47,397747    192.168.100.157    192.168.100.116    SMB2    154    GetInfo Response
35    23:45:47,404487    192.168.100.116    192.168.100.157    DCERPC    397    Bind: call_id: 2, Fragment: Single, 3 context items: SPOOLSS V1.0 (32bit NDR), SPOOLSS V1.0 (64bit NDR), SPOOLSS V1.0
(6cb71c2c-9812-4540-0300-000000000000), NTLMSSP_NEGOTIATE
38    23:45:47,404938    192.168.100.157    192.168.100.116    SMB2    138    Write Response
39    23:45:47,404987    192.168.100.116    192.168.100.157    SMB2    171    Read Request Len:1024 Off:0 File: spoolss
40    23:45:47,406076    192.168.100.157    192.168.100.116    DCERPC    404    Bind_ack: call_id: 2, Fragment: Single, max_xmit: 4280 max_recv: 4280, 1 results: Acceptance, NTLMSSP_CHALLENGE
41    23:45:47,406421    192.168.100.116    192.168.100.157    DCERPC    682    AUTH3: call_id: 2, Fragment: Single, NTLMSSP_AUTH, User: DOMAIN\Administrator
42    23:45:47,406798    192.168.100.157    192.168.100.116    SMB2    138    Write Response
43    23:45:47,406858    192.168.100.116    192.168.100.157    SPOOLSS    506    OpenPrinterEx request

Local Account 2021-10 Update (failing) against 4.13.5 till credetials dialog apears

2    11:01:55,341384    192.168.215.102    192.168.215.221    SMB2    210    Create Response File: spoolss
3    11:01:55,341481    192.168.215.221    192.168.215.102    SMB2    162    GetInfo Request FILE_INFO/SMB2_FILE_STANDARD_INFO File: spoolss
4    11:01:55,343559    192.168.215.102    192.168.215.221    SMB2    154    GetInfo Response
5    11:01:55,343871    192.168.215.221    192.168.215.102    DCERPC    397    Bind: call_id: 2, Fragment: Single, 3 context items: SPOOLSS V1.0 (32bit NDR), SPOOLSS V1.0 (64bit NDR), SPOOLSS V1.0
(6cb71c2c-9812-4540-0300-000000000000), NTLMSSP_NEGOTIATE
6    11:01:55,345717    192.168.215.102    192.168.215.221    SMB2    138    Write Response
7    11:01:55,345772    192.168.215.221    192.168.215.102    SMB2    171    Read Request Len:1024 Off:0 File: spoolss
8    11:01:55,347636    192.168.215.102    192.168.215.221    DCERPC    456    Bind_ack: call_id: 2, Fragment: Single, max_xmit: 4280 max_recv: 4280, 3 results: Acceptance, Provider rejection,
Negotiate ACK, NTLMSSP_CHALLENGE
9    11:01:55,347946    192.168.215.221    192.168.215.102    DCERPC    694    AUTH3: call_id: 2, Fragment: Single, NTLMSSP_AUTH, User: CLIENT\Administrator
10    11:01:55,350096    192.168.215.102    192.168.215.221    SMB2    138    Write Response
11    11:01:55,350144    192.168.215.221    192.168.215.102    SPOOLSS    530    OpenPrinterEx request
12    11:01:55,351891    192.168.215.102    192.168.215.221    DCERPC    202    Fault: call_id: 2, Fragment: Single, Ctx: 0, status: nca_proto_error
13    11:01:55,351935    192.168.215.221    192.168.215.102    SMB2    146    Close Request File: spoolss
14    11:01:55,353349    192.168.215.102    192.168.215.221    SMB2    182    Close Response
177    11:02:02,169424    192.168.215.221    192.168.215.102    SMB2    192    Create Request File: spoolss
178    11:02:02,172480    192.168.215.102    192.168.215.221    SMB2    210    Create Response File: spoolss
179    11:02:02,172607    192.168.215.221    192.168.215.102    SMB2    162    GetInfo Request FILE_INFO/SMB2_FILE_STANDARD_INFO File: spoolss
180    11:02:02,175189    192.168.215.102    192.168.215.221    SMB2    154    GetInfo Response
181    11:02:02,175661    192.168.215.221    192.168.215.102    DCERPC    397    Bind: call_id: 2, Fragment: Single, 3 context items: SPOOLSS V1.0 (32bit NDR), SPOOLSS V1.0 (64bit NDR), SPOOLSS V1.0
(6cb71c2c-9812-4540-0300-000000000000), NTLMSSP_NEGOTIATE
182    11:02:02,178260    192.168.215.102    192.168.215.221    SMB2    138    Write Response
183    11:02:02,178385    192.168.215.221    192.168.215.102    SMB2    171    Read Request Len:1024 Off:0 File: spoolss
184    11:02:02,181041    192.168.215.102    192.168.215.221    DCERPC    456    Bind_ack: call_id: 2, Fragment: Single, max_xmit: 4280 max_recv: 4280, 3 results: Acceptance, Provider rejection,
Negotiate ACK, NTLMSSP_CHALLENGE
185    11:02:02,181660    192.168.215.221    192.168.215.102    DCERPC    694    AUTH3: call_id: 2, Fragment: Single, NTLMSSP_AUTH, User: CLIENT\Administrator
186    11:02:02,184322    192.168.215.102    192.168.215.221    SMB2    138    Write Response
187    11:02:02,184478    192.168.215.221    192.168.215.102    SPOOLSS    530    OpenPrinterEx request
188    11:02:02,187065    192.168.215.102    192.168.215.221    DCERPC    202    Fault: call_id: 2, Fragment: Single, Ctx: 0, status: nca_proto_error
189    11:02:02,187204    192.168.215.221    192.168.215.102    SMB2    146    Close Request File: spoolss
190    11:02:02,189570    192.168.215.102    192.168.215.221    SMB2    182    Close Response
233    11:02:04,560074    192.168.215.102    192.168.215.221    SMB2    282    Negotiate Protocol Response
234    11:02:04,560114    192.168.215.221    192.168.215.102    SMB2    232    Negotiate Protocol Request
235    11:02:04,562905    192.168.215.102    192.168.215.221    SMB2    342    Negotiate Protocol Response
236    11:02:04,563447    192.168.215.221    192.168.215.102    SMB2    220    Session Setup Request, NTLMSSP_NEGOTIATE
237    11:02:04,566206    192.168.215.102    192.168.215.221    SMB2    355    Session Setup Response, Error: STATUS_MORE_PROCESSING_REQUIRED, NTLMSSP_CHALLENGE
238    11:02:04,566431    192.168.215.221    192.168.215.102    SMB2    671    Session Setup Request, NTLMSSP_AUTH, User: CLIENT\Administrator
239    11:02:04,570768    192.168.215.102    192.168.215.221    SMB2    131    Session Setup Response, Error: STATUS_LOGON_FAILURE

And after I entered credentials

2    11:09:29,309181    192.168.215.221    192.168.215.102    SMB2    192    Create Request File: spoolss
3    11:09:29,312382    192.168.215.102    192.168.215.221    SMB2    210    Create Response File: spoolss
4    11:09:29,312446    192.168.215.221    192.168.215.102    SMB2    162    GetInfo Request FILE_INFO/SMB2_FILE_STANDARD_INFO File: spoolss
5    11:09:29,314415    192.168.215.102    192.168.215.221    SMB2    154    GetInfo Response
6    11:09:29,314724    192.168.215.221    192.168.215.102    DCERPC    397    Bind: call_id: 2, Fragment: Single, 3 context items: SPOOLSS V1.0 (32bit NDR), SPOOLSS V1.0 (64bit NDR), SPOOLSS V1.0
(6cb71c2c-9812-4540-0300-000000000000), NTLMSSP_NEGOTIATE
7    11:09:29,317061    192.168.215.102    192.168.215.221    SMB2    138    Write Response
8    11:09:29,317096    192.168.215.221    192.168.215.102    SMB2    171    Read Request Len:1024 Off:0 File: spoolss
9    11:09:29,319404    192.168.215.102    192.168.215.221    DCERPC    456    Bind_ack: call_id: 2, Fragment: Single, max_xmit: 4280 max_recv: 4280, 3 results: Acceptance, Provider rejection,
Negotiate ACK, NTLMSSP_CHALLENGE
10    11:09:29,319764    192.168.215.221    192.168.215.102    DCERPC    694    AUTH3: call_id: 2, Fragment: Single, NTLMSSP_AUTH, User: CLIENT\Administrator
11    11:09:29,322028    192.168.215.102    192.168.215.221    SMB2    138    Write Response
12    11:09:29,322076    192.168.215.221    192.168.215.102    SPOOLSS    530    OpenPrinterEx request
13    11:09:29,324275    192.168.215.102    192.168.215.221    DCERPC    202    Fault: call_id: 2, Fragment: Single, Ctx: 0, status: nca_proto_error
14    11:09:29,324314    192.168.215.221    192.168.215.102    SMB2    146    Close Request File: spoolss
15    11:09:29,326182    192.168.215.102    192.168.215.221    SMB2    182    Close Response
55    11:09:36,093287    192.168.215.221    192.168.215.102    SMB2    192    Create Request File: spoolss
56    11:09:36,096249    192.168.215.102    192.168.215.221    SMB2    210    Create Response File: spoolss
57    11:09:36,096377    192.168.215.221    192.168.215.102    SMB2    162    GetInfo Request FILE_INFO/SMB2_FILE_STANDARD_INFO File: spoolss
58    11:09:36,098156    192.168.215.102    192.168.215.221    SMB2    154    GetInfo Response
59    11:09:36,098620    192.168.215.221    192.168.215.102    DCERPC    397    Bind: call_id: 2, Fragment: Single, 3 context items: SPOOLSS V1.0 (32bit NDR), SPOOLSS V1.0 (64bit NDR), SPOOLSS V1.0
(6cb71c2c-9812-4540-0300-000000000000), NTLMSSP_NEGOTIATE
60    11:09:36,100379    192.168.215.102    192.168.215.221    SMB2    138    Write Response
61    11:09:36,100437    192.168.215.221    192.168.215.102    SMB2    171    Read Request Len:1024 Off:0 File: spoolss
62    11:09:36,102643    192.168.215.102    192.168.215.221    DCERPC    456    Bind_ack: call_id: 2, Fragment: Single, max_xmit: 4280 max_recv: 4280, 3 results: Acceptance, Provider rejection,
Negotiate ACK, NTLMSSP_CHALLENGE
63    11:09:36,102995    192.168.215.221    192.168.215.102    DCERPC    694    AUTH3: call_id: 2, Fragment: Single, NTLMSSP_AUTH, User: CLIENT\Administrator
64    11:09:36,105102    192.168.215.102    192.168.215.221    SMB2    138    Write Response
65    11:09:36,105238    192.168.215.221    192.168.215.102    SPOOLSS    530    OpenPrinterEx request
66    11:09:36,107332    192.168.215.102    192.168.215.221    DCERPC    202    Fault: call_id: 2, Fragment: Single, Ctx: 0, status: nca_proto_error
67    11:09:36,107397    192.168.215.221    192.168.215.102    SMB2    146    Close Request File: spoolss
68    11:09:36,109318    192.168.215.102    192.168.215.221    SMB2    182    Close Response
85    11:09:38,467981    192.168.215.102    192.168.215.221    SMB2    282    Negotiate Protocol Response
86    11:09:38,468067    192.168.215.221    192.168.215.102    SMB2    232    Negotiate Protocol Request
87    11:09:38,471468    192.168.215.102    192.168.215.221    SMB2    342    Negotiate Protocol Response
88    11:09:38,472362    192.168.215.221    192.168.215.102    SMB2    220    Session Setup Request, NTLMSSP_NEGOTIATE
89    11:09:38,475465    192.168.215.102    192.168.215.221    SMB2    355    Session Setup Response, Error: STATUS_MORE_PROCESSING_REQUIRED, NTLMSSP_CHALLENGE
90    11:09:38,475959    192.168.215.221    192.168.215.102    SMB2    671    Session Setup Request, NTLMSSP_AUTH, User: CLIENT\Administrator
91    11:09:38,480574    192.168.215.102    192.168.215.221    SMB2    131    Session Setup Response, Error: STATUS_LOGON_FAILURE

Two days ago there was an 2021-10 preview update release which does not fix things, i did not yet capture traffic with that installed.