Scan to folder not working after a Windows update

What Microsoft changed

In scan to folder, the copier is the one connecting: it signs in to a shared folder on a PC, a server or a NAS over SMB, the Windows file-sharing protocol. These changes decide whether Windows lets it in:

Microsoft's own troubleshooting article for file shares puts it plainly: “Most modern Access Denied cases are caused by secure-by-default changes rather than misconfiguration.”

Sources: Microsoft Learn, SMB security hardening; Microsoft Learn, Detect, enable, and disable SMBv1, SMBv2, and SMBv3 in Windows; Windows IT Pro Blog, Retiring NTLM: Frequently asked questions; Microsoft Support, How to manage Kerberos KDC usage of RC4 for service account ticket issuance changes related to CVE-2026-20833; Microsoft Learn, Access Denied when you access an SMB file share in Windows (read October 30, 2026)

SMB signing is required

“Starting with Windows 11 24H2 and Windows Server 2025, all outbound and inbound SMB connections are now required to be signed by default.”Microsoft Learn, SMB security hardening

“Previously, SMB signing was only required by default for connections to shares named SYSVOL and NETLOGON, and for clients of AD domain controllers.” And: “Enabling SMB signing causes clients and servers to only accept packets that are signed, and reject any that aren't.” So a PC on Windows 11 24H2 that holds the scans folder now refuses a copier that doesn't sign.

Look for a signing setting in the copier's SMB client settings. On a Konica Minolta bizhub 360i, for example: “Select whether to enable the SMB signature of this machine to suit your environment (default: [When requested]).” If the copier has no such setting, look for a firmware update; if there's none, it can't scan to a folder on a 24H2 PC (scan to email still works: see below).

For Windows Server 2025 file servers, Microsoft's 2024 announcement worded it differently: “We now require signing by default for all Windows 11 24H2 SMB outbound and inbound connections and for all outbound connections in Windows Server 2025.” Rather than assume, check the server itself. In PowerShell, Microsoft's check is Get-SmbServerConfiguration | FL RequireSecuritySignature; True means signing is on.

Sources: Microsoft Learn, SMB security hardening; Microsoft's Storage at Microsoft blog, SMB security hardening in Windows Server 2025 & Windows 11; Microsoft Learn, Control SMB signing behavior; Konica Minolta, bizhub 360i manual, Configuring the SMB Send environment (read October 30, 2026)

SMBv1 isn't there

“SMBv1 isn't installed by default in any edition of Windows 11 or Windows Server 2019 and later versions.” “SMBv1 also isn't installed by default in Windows 10, except Home and Pro editions.” A copier old enough to speak only SMBv1 has nothing to connect to. Look in its SMB settings for SMB 2 or SMB 3, which may need a firmware update. Microsoft advises against the shortcut: what not to do.

Source: Microsoft Learn, Detect, enable, and disable SMBv1, SMBv2, and SMBv3 in Windows (read October 30, 2026)

NTLMv1 sign-in is blocked

“NTLMv1 was blocked and rendered non-functional starting with Windows Server 2025 and Windows 11, version 24H2, with related changes rolling out through recent updates.”

A copier can come set to sign in with NTLMv1. Konica Minolta's manual for the bizhub 958 says of its SMB authentication setting: “[NTLM v1] is specified by default.” (under [Utility][Administrator Settings][Network Settings][SMB Settings][Client Settings]). On the newer bizhub 360i: “Select an authentication method for SMB transmission according to your environment (default: [NTLM v1/v2]).” Where the copier offers it, pick NTLMv2 or Kerberos.

Sources: Windows IT Pro Blog, Retiring NTLM: Frequently asked questions; Konica Minolta, bizhub 958 manual, Client Settings; Konica Minolta, bizhub 360i manual, Configuring the SMB Send environment (read October 30, 2026)

Kerberos RC4 is off on domain controllers

Microsoft is retiring an old encryption type in Kerberos, the sign-in system of Windows domains, in three steps:

• January 13, 2026: Initial Deployment Phase
• April 14, 2026: Enforcement Phase with manual rollback
• July 2026: Enforcement Phase

“This hardening change only impacts Windows domain controllers.” Once enforced, domain controllers issue only AES tickets to accounts that have no encryption types set. Microsoft's RC4 guide names file shares among what fails: “when you attempt to access a share using SMB and RC4 is the only value for msDS-SupportedEncryptionTypes, an authentication failure generates a network error”.

For scan to folder, this matters only when the copier signs in with Kerberos (on a Konica Minolta bizhub 360i, single sign-on needs it) and either the copier can't use AES or the account it signs in as has no AES keys. Microsoft's fix for old accounts: “For accounts created before AES-SHA1 support, reset passwords to generate modern encryption keys, such as AES-SHA1.” Its advice for devices that can't use AES: “our long-term recommendation is to migrate non-Windows devices to versions that support AES-SHA1 Kerberos ticket encryption”.

Sources: Microsoft Support, How to manage Kerberos KDC usage of RC4 for service account ticket issuance changes related to CVE-2026-20833; Microsoft Learn, Detect and remediate RC4 usage in Kerberos (read October 30, 2026)

Guest access is blocked

This one hits offices whose copier scans to a NAS share with no password. The copier may still save there, but the PCs can't open the folder: “By default, Windows 11 Pro no longer permits SMB client guest connections or guest fallback to an SMB server.” And on 24H2: “Furthermore, SMB signing cannot be used with guest credentials.” Microsoft's order of fixes for the NAS starts with:

1. “Enable SMB signing in your third-party NAS.”
2. “Disable guest access in your third-party NAS.”
3. “Enable a username and password in your third-party NAS.”

Then give the copier the same username and password in its scan destination.

Sources: Microsoft Learn, SMB security hardening; Microsoft's Storage at Microsoft blog, Accessing a third-party NAS with SMB in Windows 11 24H2 may fail (read October 30, 2026)

Check the copier and the share

On the copier's built-in web page (its IP address in a browser, signed in as the administrator) and on the PC or server:

1. Firmware. Update it first. Microsoft's advice for devices that can't sign is to update or replace them.
2. SMB version. SMB 2 or 3 on. SMBv1 alone won't connect to a current Windows PC or server.
3. Signing. On, or set to sign when the server asks.
4. Sign-in method. NTLMv2 or Kerberos, not NTLMv1.
5. The account. A real username and password, not guest, with permission to the folder in both the share and its security settings. If it's an old domain account, reset its password.
6. The address. With Kerberos, point the copier at the server's name, not its IP address: “Kerberos does not natively understand IP addresses, so authentication requests made using an IP address (rather than an SPN) fall back to NTLM.”
7. The port. SMB uses port 445 (Xerox's guide: “Type 445 into the Port field.”). Xerox also points to the PC's Windows Firewall and antivirus when the test fails.

Sources: Microsoft Learn, Detect, enable, and disable SMBv1, SMBv2, and SMBv3 in Windows; Microsoft Learn, Access Denied when you access an SMB file share in Windows; Windows IT Pro Blog, Retiring NTLM: Frequently asked questions; Xerox Support, How to Configure Scan to SMB (KB0426910) (read October 30, 2026)

What not to do

Turning the protections off makes the copier work again and leaves every PC and server more exposed. Microsoft says: “Don't disable SMB protocol versions or SMB signing to work around these connection failures.” and “Instead, enable SMB signing on the remote server, or update or replace devices that don't support SMB signing.” On guest access: “We recommend that you don't enable insecure guest logons.” And putting RC4 back for the whole domain leaves every account open to the flaw the change fixes; Microsoft's fallback is an exception on the one account that needs it.

Sources: Microsoft Learn, Detect, enable, and disable SMBv1, SMBv2, and SMBv3 in Windows; Microsoft Learn, How to enable insecure guest logons in SMB2 and SMB3; Microsoft Support, How to manage Kerberos KDC usage of RC4 for service account ticket issuance changes related to CVE-2026-20833 (read October 30, 2026)

Next: NTLM off by default

Copiers often sign in to shares with NTLM (it's the factory setting on both Konica Minolta models above), and Microsoft's FAQ says outright that “non-Windows clients (macOS, Linux, Android, iOS, network appliances) can and do use NTLM when connecting to Windows resources such as SMB file shares”. The next step is set: “Network NTLM will be disabled by default.” “NTLM usage will require explicit re-enablement through new policy controls.” When? “Our current target for default disablement is the next major release of Server and Client (subject to change).”

A copier that can only do NTLM will then need an exception on the server, or a route that doesn't use a file share.

Sources: Windows IT Pro Blog, Retiring NTLM: Frequently asked questions; Windows IT Pro Blog, Advancing Windows security: Disabling NTLM by default (read October 30, 2026)

Skip the share: scan to email

When the copier can't be brought up to date, scan to email takes the file share out of the picture: no SMB, no signing, no NTLM or Kerberos. Scans arrive as attachments instead of files in a folder. With Microsoft 365 there's one catch: notice MC786329 says “End of December 2026: SMTP AUTH Basic Authentication will be disabled by default for existing tenants.” So set it up on a route that lasts:

• OAuth on the device. SMTP AUTH supports OAuth as well as passwords, and it's the method Microsoft recommends. It works if your copier's maker supports it on your model and firmware: see the guide and your brand's page.
• An SMTP relay connector. The device sends to your MX endpoint on port 25, and Microsoft 365 recognises it by your static IP address or a certificate. Steps.
• Direct Send or High Volume Email, if scans only ever go to people inside your organization. Details.
• A third-party relay, which Microsoft's notice names for anything that must keep a username and password: “if you must use Basic auth to send email with Exchange Online, then you must use one of the alternatives or a 3P solution.”

Step by step for each route: scan to email with Microsoft 365. Already set up and failing? Scan to email not working.

By brand

Setting names differ by maker and model. Konica Minolta's SMB client settings are under [Network] - [SMB Setting] - [Client Setting] on the bizhub 360i; Xerox sets scan to SMB up as a file repository on the device's web page, port 445. For the others, the SMB or scan-destination settings in the maker's manual. Scan to email setup, brand by brand:

Canon, Ricoh, Xerox, HP, Konica Minolta, Kyocera, Sharp, Brother, Epson and Lexmark.

Common questions