Scan to SMB Windows Server 2025

Hi all. We have a couple new 2025 servers in a AD environment. One of the servers is a new DC, which is working fine (other DC is still on Server 2016). Another Server 2025 VM is a file server. This file server is being tested to receive files scanned from a Konica Minolta Bizhub C451i over SMB. The scans are failing with the following events:

Event 551

Task Category: Smb2SessionAuthFailure

Level: Error

Keywords: Audit Failure,Operational

Description: SMB Session Authentication Failure

Status: The attempted logon is invalid. This is either due to a bad username or authentication information. (0xC000006D)

SPN: session setup failed before the SPN could be queried

SPN Validation Policy: SPN optional / no validation

Guidance:

You should expect this error when attempting to connect to shares using incorrect credentials.

This error does not always indicate a problem with authorization, but mainly authentication. It is more common with non-Windows clients.

This error can occur when using incorrect usernames and passwords with NTLM, mismatched LmCompatibility settings between client and server, an incorrect service principal name, duplicate Kerberos service principal names, incorrect Kerberos ticket-granting service tickets, or Guest accounts without Guest access enabled.

Event 1009

Task Category: SrvSessionAnonymousAccessDenied

Level: Error

Keywords: Audit Failure,Operational

Description: The server denied anonymous access to the client.

Guidance:

You should expect this error when a client attempts to connect to shares and does not provide any credentials. This indicates that the client is not providing a user name (and domain credentials, if necessary). By default, Windows Server denies anonymous access to shares.

This error does not always indicate a problem with authorization, but mainly authentication. It is more common with non-Windows clients.

-----------------------------------------------------------

The username and password are definitely correct, and the MFP is passing creds; so, it's not really anonymous as suggested by the error. We have tried different formats domain\username, username, username@domain.local. As a test, we enabled SMB 1.0 temporarily. The current server that works with this scan to SMB is Server 2016. The MFP and the server is on the same LAN; so, there is no firewall in between; so, no NAT. Also, the Windows Defender Firewall is currently disabled to rule that out as the cause.

We are working to decipher the differences in SMB settings between the two servers (working 2016 server and non-working 2025 server), but I thought I'd throw this out to everyone at Reddit to see if anyone has a good idea of what the issue could be.