Installing Continuity Engine on Windows Servers configured to allow SMBv3 connections only

Installing Continuity Engine on Windows Servers configured to allow SMBv3 connections only

Summary

This knowledgebase article provides information regarding the installation of Continuity Engine on Windows Servers configured to allow SMBv3 connections only 

Foreword

Allowing SMBv3 only client connections is a custom configuration performed on a Windows Server (starting with 2012). By default. Windows Server (i.e. 2019) is configured allow SMB 3.1.1 or 2.0. When a connection to an SMB server is established, the client will negotiate which protocol versions are available on both sides and then use the highest possible version. Thus, Engine Management service (client) and Engine target (server) will agree on using SMBv2, which works for the default SMB server configurations.

Continuity Engine vs. SMBv3

Situation / Verdict

Continuity Engine Management Service cannot install or upgrade target servers configured to allow SMBv3 connections only. This means target server was configured to allow only SMBv3 encrypted connections to ALL its encrypted shares. To check this, on the target server verify the following SMB server properties via PowerShell:

​PS C:\Users\Administrator> Get-SmbServerConfiguration | Select RejectUnencryptedAccess
RejectUnencryptedAccess
-----------------------
                    True

PS C:\Users\Administrator> Get-SmbServerConfiguration | Select EncryptData
EncryptData
----------- 
     True

Reason

EMS current design combined with SMB functionality

  1. Even if the actual OS has SMBv3 capabilities (these are present since WS2012), EMS remote execution code is using SMBv2 to access target server. EMS creates a random name folder inside C:\Windows\Temp where it copies all the tools needed for validation/install/upgrade. Because only SMBv3 client connections are accepted, the SMBv2 client initiated access is not authorized, hence Engine validation/install/upgrade fails.

Workaround

Configure target server to temporary allow SMBv2 while Engine is being installed or upgraded,  by either of the following:
  1. set all shares as unencrypted

    1. Set-SmbServerConfiguration –EncryptData $false

  2. allow unencrypted access

    1. Set-SmbServerConfiguration –RejectUnencryptedAccess $false

Once Engine is installed or upgraded you my safely revert to allow only SMBv3 connections:

  1. set all shares as encrypted

    1. Set-SmbServerConfiguration –EncryptData $true

  2. reject unencrypted access

    1. Set-SmbServerConfiguration –RejectUnencryptedAccess $true

Related articles

Applies to

Continuity Engine 9.x (and later)