Shared printers and scan-to-folder vanished after a Windows 11 update: SMB signing, guest access, and KB5065426

Windows 11 24H2 requires SMB signing by default on every connection, and on the Pro edition it no longer falls back to guest access when a share asks for no credentials. A copier scanning to a folder with a blank password, or an old NAS that cannot sign, is refused. This is a deliberate hardening, and it is not going back.

The September 2025 cumulative update for 24H2, KB5065426, together with the August preview before it, hardened how Windows authenticates PCs to each other. Machines that were cloned from the same image without being generalized share a machine identifier, and after the update they refuse each other's file and printer sharing, with credential prompts and errors that look like a wrong password. Microsoft published a rollback for it; the durable fix is elsewhere.

The third is older and gets blamed on the other two: a printer shared from somebody's PC instead of a server disappears whenever that PC sleeps, changes its network profile to Public, or has its discovery services stopped by an update.

Fix it on the copier, in this order:

1. In the copier's scan destination, switch the protocol to SMB version 2 or 3; SMB version 1 is off in Windows and should stay off
2. Give the copier a real account: a dedicated scan user with a strong password and rights only to the scan folder, entered in the copier's destination settings; no more blank credentials
3. If the copier's firmware offers SMB signing, turn it on; if it does not, look for a firmware update before looking for a workaround
4. On the Windows side, share the folder to that account only, and test from one 24H2 PC before touching the others
5. If the copier is too old to speak SMB version 2 with credentials, its scanning days on a Windows share are over: scan to email through your mail provider's authenticated relay, or to a cloud folder through the vendor's connector, or replace the copier, which the dealer will be glad to discuss

The tell is a fleet of PCs built by cloning a disk image without running the generalization step, which is common in small offices and in fleets a previous provider built quickly. After KB5065426 those PCs cannot share files or printers with each other, remote desktop between them fails, and the errors mention a logon failure even though the password is right.

Microsoft shipped a Known Issue Rollback for it, delivered as a Group Policy package, which restores the old behaviour while it is in place. Use it to stop the bleeding. Then rebuild the affected machines properly, from a generalized image or through Autopilot, because duplicate machine identifiers were never supported and this will not be the last update to notice them.

Servers and Windows 10 machines were not affected; the problem is between Windows 11 24H2 peers, which is why it looked like the servers were fine and the office was broken.

A PC is a poor print server. It sleeps, it updates, it is the one machine that goes home on Friday, and every update that touches network discovery or the firewall profile hides its shares from the rest of the office. If the fix after each update is to sit at that PC and toggle sharing back on, the real fix is a print server or Universal Print, or at least a queue on each PC that points at the printer's own reserved address, which the guide to printers that keep going offline walks through.

• Do not turn off the SMB signing requirement on every PC by policy so the copier works again
• Do not re-enable insecure guest logons, and do not install SMB version 1, however many forum posts recommend it
• Do not disable Windows Defender Firewall to see whether it helps; it will help, and then it will stay off

Each of those is a setting the ransomware playbooks assume is still on, and each fixes a copier by exposing the whole office. The copier is one device with one setting to change; the PCs are forty devices whose defaults are now correct.

1. List every scan destination and every shared printer, and which PC or server hosts each
2. Check the copier's firmware version against the vendor's current release
3. Create the scan account, change the copier's destination, and test from one updated PC
4. Move the shared printers to a server or to direct queues, and remove the PC-hosted shares
5. Write down what changed, including the account name and where its password is kept, so the next firmware update does not start the investigation again

This is the shape of the printer and scanner work on our Enterprise IT services page: fixed on the device at the cause, with the PCs left as hardened as the update made them.