| Previous | Next |
| STATUS_NETWORK_NAME_DELETED | STATUS_BAD_DEVICE_TYPE |
STATUS_NETWORK_ACCESS_DENIED
STATUS_NETWORK_ACCESS_DENIED confirms more than a routing failure: the request reached a remote network resource and was rejected by an access decision. For SMB, separate the share-connect authorization from later file-system authorization. A user can reach a server and even authenticate successfully while still being denied access to a particular share.
How to narrow it down
Collect the authenticated identity, server name, share name and operation stage. The SMB2 Tree Connect rules explicitly evaluate the session security context against the share-connect security policy. That is distinct from permissions applied later to a directory or file.
Do not weaken signing, encryption or authentication requirements to make this status disappear. First identify which server-side policy rejected the request and whether the intended account and authorization context were used.
Evidence that matters
- Record the account form used for authentication and the resulting session identity.
- Distinguish a Tree Connect denial from an NTFS or application-level denial after a share is connected.
- Check server-side authorization logs for the same share and time window.
References
- Microsoft Open Specifications: NTSTATUS reference
- MS-SMB2: SMB2 TREE_CONNECT processing
- Microsoft: SMB security enhancements
Looking for a different code? Search another status or error code.