| Previous | Next |
| ERROR_VHDSET_BACKING_STORAGE_NOT_FOUND | ERROR_SMB_BAD_CLUSTER_DIALECT |
ERROR_SMB_NO_PREAUTH_INTEGRITY_HASH_OVERLAP
Investigate SMB 3.1.1 preauthentication hash negotiation failure at the first returning call, before a wrapper substitutes a generic message. During SMB negotiate, client and server advertised no common preauthentication integrity hash algorithm. The session is rejected before normal authentication because the transcript-protection algorithm cannot be agreed.
The relevant contract
These SMB results arise during capability negotiation, before normal file authorization. NEGOTIATE packets and cluster or server capability state are more useful than changing share ACLs.
This is earlier than signing, encryption, Kerberos, or share authorization. Changing credentials cannot create a common preauthentication hash. Keep ERROR_SMB_NO_PREAUTH_INTEGRITY_HASH_OVERLAP, its numeric value, and the first returning operation together.
Capture before changing state
| Capture | Diagnostic value |
|---|---|
| Client and server dialect lists, preauthentication hash lists, negotiate request/response, and Windows/Samba versions. | Identifies the concrete object and operation associated with SMB 3.1.1 preauthentication hash negotiation failure. |
| Middlebox or cluster node that may alter or terminate SMB negotiation. | Separates argument or lifecycle state from a lower-layer provider failure. |
| Policy hardening changes and whether every cluster node exposes the same algorithm set. | Creates a stable before-and-after comparison. |
| Packet capture through NEGOTIATE only, without credentials or application payload. | Shows whether this condition is the first result or a translated summary. |
For ERROR_SMB_NO_PREAUTH_INTEGRITY_HASH_OVERLAP preserve middlebox or cluster node that may alter or terminate SMB negotiation before reinstalling, rebooting, clearing state, or substituting another device or provider. A success observed only after such a change is useful comparison data for this HRESULT but it does not identify the original cause.
Focused experiments
- Connect directly to one server node using SMB 3.1.1.
- Compare a client with default algorithm policy to the hardened client. Treat a changed result as a separate failure rather than automatic resolution.
- Verify each cluster node advertises the same dialect and preauthentication capabilities. Repeat the original supported operation so the check remains tied to the same API boundary.
A defensible resolution
Targeted correction. Restore an overlapping supported algorithm set by updating or consistently configuring both endpoints; do not downgrade the dialect merely to bypass transcript protection.
Acceptance criterion. SMB 3.1.1 negotiation completes on every intended node, the selected hash is visible in trace, and authentication proceeds without protocol downgrade.
Technical references
References for ERROR_SMB_NO_PREAUTH_INTEGRITY_HASH_OVERLAP on the deployed platform version.
- Microsoft Open Specifications: HRESULT values — defines the status namespace used.
- Microsoft: HRESULT facility extraction — documents the API or lifecycle behind this condition.
- Microsoft Open Specifications: SMB2 — provides ABI, implementation, or protocol context.
- Microsoft: SMB security enhancements — supports the portability and verification limits.
Looking for a different code? Search another status or error code.