Enabling SMB Guest Access for Roon Nucleus / ROCK on Windows
When attempting to get access to the internal storage of a Roon Nucleus or Roon Optimized Core Kit (ROCK) from a Windows PC, you may encounter an error message or a persistent password prompt (even when entering the correct credentials Guest/Guest).
Why is this happening?
This issue arises from a conflict between the convenience settings of the Nucleus and the tightened security standards of modern Windows operating systems.
Nucleus/ROCK Protocol: To make the device as "plug-and-play" as possible, the Roon OS shares its internal storage using SMB Guest Access. This allows users to connect without needing to create specific users or manage complex permissions.
Windows Security Policies: In recent updates to Windows 10 and Windows 11, Microsoft has disabled "Insecure Guest Logons" by default. Windows treats unauthenticated guest access as a potential security vulnerability.
Consequently, Windows blocks the connection to the Nucleus because the Nucleus does not ask for a secure, authenticated login. To resolve this, you must explicitly allow Windows to connect to "Guest" network shares.
How to Fix It
Please follow the instructions below based on your specific version of Windows.
Windows 10 (1709 – 22H2) and Windows 11 (up to 23H2)
Press Win + R, type gpedit.msc, and press Enter.
In the Local Group Policy Editor, navigate to:
Computer Configuration > Administrative Templates > Network > SMB Client
Locate Allow insecure guest logons.
Double-click the setting → set it to Enabled → click OK.
Press Win + R, type
gpedit.msc, and press Enter.In the Local Group Policy Editor, navigate to:
Computer Configuration > Administrative Templates > Network > SMB ClientLocate Allow insecure guest logons.
Double-click the setting → set it to Enabled → click OK.
Disable the SMB client signing requirement
Navigate to:
Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
Locate Microsoft network client: Digitally sign communications (always).
Double-click → set to Disabled → click OK.
Navigate to:
Computer Configuration > Windows Settings > Security Settings > Local Policies > Security OptionsLocate Microsoft network client: Digitally sign communications (always).
Double-click → set to Disabled → click OK.
Windows 11 (24H2 and later)
Press Win + R, type gpedit.msc, and press Enter.
In the Local Group Policy Editor, navigate to:
Computer Configuration > Administrative Templates > Network > Lanman Workstation
Locate Enable insecure guest logons.
Double-click → set to Enabled → click OK.
Press Win + R, type
gpedit.msc, and press Enter.In the Local Group Policy Editor, navigate to:
Computer Configuration > Administrative Templates > Network > Lanman WorkstationLocate Enable insecure guest logons.
Double-click → set to Enabled → click OK.
Disable the SMB client signing requirement
Navigate to:
Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options
Locate Microsoft network client: Digitally sign communications (always).
Double-click → set to Disabled → click OK.
Navigate to:
Computer Configuration > Windows Settings > Security Settings > Local Policies > Security OptionsLocate Microsoft network client: Digitally sign communications (always).
Double-click → set to Disabled → click OK.
Windows Home (using PowerShell)
The Group Policy Editor is not available on Windows Home editions. The required settings must be applied using PowerShell.
Press Start, type PowerShell.
Right-click Windows PowerShell and select Run as administrator.
Accept the UAC prompt.
The Group Policy Editor is not available on Windows Home editions. The required settings must be applied using PowerShell.
Press Start, type PowerShell.
Right-click Windows PowerShell and select Run as administrator.
Accept the UAC prompt.
Enable insecure guest logons
Run:
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation" /v AllowInsecureGuestAuth /t REG_DWORD /d 1 /f
Run:
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\LanmanWorkstation" /v AllowInsecureGuestAuth /t REG_DWORD /d 1 /f
Disable the SMB client signing requirement
Run:
reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v RequireSecuritySignature /t REG_DWORD /d 0 /f
Restart the computer to apply the changes
Run:
reg add "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters" /v RequireSecuritySignature /t REG_DWORD /d 0 /f
Restart the computer to apply the changes
How to Connect to Your Storage
Once you have adjusted the Windows settings above, you can connect to your specific device.
Open File Explorer on Windows (or Finder on macOS).
If prompted for a username and password, enter Guest for both.
Type the address corresponding to your specific Roon model into the address bar:
For Windows Users:
Nucleus One:
\\NUCLEUSONE\Data\Storage\InternalStorageNucleus Titan:
\\NUCLEUSTITAN\Data\Storage\InternalStorageNucleus (Standard):
\\NUCLEUS\Data\Storage\InternalStorageNucleus+:
\\NUCLEUSPLUS\Data\Storage\InternalStorageROCK:
\\ROCK\Data\Storage\InternalStorage
For macOS Users:
Nucleus One:
smb://NUCLEUSONE/Data/Storage/InternalStorageNucleus Titan:
smb://NUCLEUSTITAN/Data/Storage/InternalStorageNucleus (Standard):
smb://NUCLEUS/Data/Storage/InternalStorageNucleus+:
smb://NUCLEUSPLUS/Data/Storage/InternalStorageROCK:
smb://ROCK/Data/Storage/InternalStorage
You can now drag and drop your music files and folders into this window to copy them to the Nucleus.
Related Articles
Nucleus Internal Storage
Your Nucleus supports an internal 2.5" HDD or SSD to create a self-contained music server. For a completely silent system, we recommend using an SSD. If you chose to use an SSD here, the system will stay fully silent. The entire internal storage ...Networking Best Practices
A properly functioning home network ensures that Roon performs as expected, with remotes connecting and loading content quickly as you browse, and audio devices that are free from dropouts and other playback issues. More complex network setups will ...RoonOS Recovery (Nucleus/ROCK)
Users are expected to try to recover their data and/or reinstall using the web UI if their device is unusable. However, if you can't even boot up Nucleus or ROCK and get to the web UI, then doing a recovery via the USB flash drive RoonOS installer is ...Nucleus Web Administration Interface
Connecting to the Web Administration Interface You can use a web browser to perform operations like configuring settings, updating firmware, formatting internal storage, and resetting to factory settings. To use Roon to help you load up the Nucleus ...Roon Optimized Core Kit
Let's first explain what Roon OS is, and then we can talk about Roon Optimized Core Kit. Roon OS is a custom Linux-based operating system, tailored for running Roon Server and providing a best-in-class, appliance-type user experience. Roon OS boots ...