Scan to Folder (SMB) Not Working on Windows 11: Causes and Fixes
In short: two security settings in Windows 11 24H2 (mandatory SMB signing and blocked guest access), together with SMBv1 no longer being installed by default, can stop a Xerox or Lexmark multifunction printer from saving scans to a shared folder. To restore scan to network folder for good, create a dedicated Windows account, share the folder with that account only, configure the printer with those credentials (port 445 on Xerox) and update its firmware. Do not disable SMB signing and do not reinstall SMBv1: you would hide the symptom while opening a security hole.
Why scan to folder fails on Windows 11
In a scan-to-folder workflow, the printer acts as an SMB client: it connects to a share on a PC or server using the credentials stored in its address book, then drops the scanned file there. When Windows refuses that connection, the scan fails, often with a vague message. Windows tightens its rules regularly (we have already covered the impact of Windows Protected Printing (WPP) on printers), and three changes are worth checking first.
SMB signing is required
On Windows 11 24H2, the Pro, Enterprise and Education editions require SMB signing for both inbound and outbound connections, while the Home edition does not (Microsoft Learn). A device that cannot sign can therefore no longer connect to the share.
Guest access is blocked
Microsoft states that requiring SMB signing also disables guest access to shares. A printer that connects without valid credentials, or with a guest account, can therefore no longer reach the folder.
SMBv1 is no longer installed
SMBv1 is not installed by default in any edition of Windows 11, and Microsoft strongly discourages its use because of its security vulnerabilities (Microsoft Learn). Yet the compatibility matrix published by Xerox (2017 document) shows that many older WorkCentre models support SMB1 only, that VersaLink C400 to C7030 and B400 to B7035 models support SMB1 and SMB 2.0, and that the AltaLink 80xx series supports SMB1, 2.0 and 3.0. The document is old: check the exact version for your model with Xerox support or D&O Partners.
The classic causes still apply
An invalid username, an empty password, a hostname the DNS cannot resolve or a wrong port will still block a scan. In its VersaLink procedure, Xerox states that using a hostname requires working DNS, that the account must be a Microsoft account or a local account on the PC hosting the share, and that port 445 is used (port 139 remains possible as an alternative).
Quick diagnosis: which symptom, which cause?
The table below links the most common symptoms to their likely cause. Start with the row that matches your situation before changing anything.
| Symptom | Likely cause | Action |
| Scanning worked before a Windows update and now fails | SMB signing required (Windows 11 24H2 Pro, Enterprise, Education) | Update the printer firmware, then check the signing status (command below) |
| Fails from the very first setup on an older device | Device limited to SMBv1 | Check the SMB versions the model supports; otherwise change the scan method |
| Connection or authentication failure message | Wrong username, empty password or guest access | Test the account from another PC, then re-enter it on the printer |
| Scanning works with the IP address but not with the PC name | DNS does not resolve the hostname | Fix the DNS or use a fixed IP address |
| The connection succeeds but the file never arrives | Insufficient write permissions | Grant the account Change rights, both on the share and on the folder’s Security tab |
| Connection refused despite correct credentials | Port not set or blocked | Enter port 445 (139 as an alternative on Xerox) and check the firewall |
On the PC hosting the share, the PowerShell command Get-SmbServerConfiguration | FL RequireSecuritySignature shows whether SMB signing is required (True) or not (False). If the printer also displays an error code, our article on Xerox error codes helps you place it.
Recommended fix: a dedicated account and a restricted share
This method follows the procedures published by Xerox and Lexmark and adds one security principle: the printer reaches a single folder, with a single account.
- Create a dedicated local Windows account (for example scan_accounting) with a long, unique password used only by the printer. Xerox accepts a local account or a Microsoft account; a local account avoids storing an employee’s credentials in the device.
- Create the folder and share it. In the folder properties, on the Sharing tab, choose Advanced Sharing, then Share this folder. Xerox also asks you to untick the Sharing Wizard (command control folders, View tab).
- Restrict the permissions to that account. Lexmark advises removing or adjusting the “Everyone” entry (read-only by default), adding each user concerned, then repeating the same accounts on the Security tab so that the folder permissions match those of the share. The Xerox procedure grants Full Control to “Everyone” at the share level; we recommend restricting access to the dedicated account instead, with the Change permission.
- Test the share from another PC. Map a network drive (\\PC-NAME\Scans) and tick “Connect using different credentials”, as Lexmark suggests. If it fails here, the problem comes from Windows and not from the printer.
- Configure the printer.
- Xerox VersaLink: open the Embedded Web Server (over https, using the device’s IPv4 address), then Address Book > Add Contact > Network (SMB). Enter the PC’s hostname or IPv4 address, port 445, the share name, the username and the password.
- Lexmark: in the Embedded Web Server, open Apps > Apps Management (or Settings > Embedded Solutions depending on the model), then the Scan to Network Folder application. Add a destination using the account that has access to the share.
- Update the firmware. The security best practices for Xerox multifunction printers recommend regular updates. If the scan still fails with correct credentials, the printer may not support the SMB signing that Windows requires: in that case, move to one of the alternatives below.
- Make the PC address reliable. Xerox recommends the hostname, which survives an IP address change, provided DNS works. Without reliable DNS, reserve a fixed IP address for the PC in DHCP.
Example settings for an accounting department
The values below are fictitious and follow the fields in the Xerox VersaLink procedure. On a Lexmark, the labels vary by model and by version of the Scan to Network Folder application.
| Setting | Example value |
| Address type | Hostname |
| Host | ACCOUNTING-PC |
| Port | 445 |
| Share | Scans |
| Document path | Empty at first (optional) |
| Username | scan_accounting |
| Password | That of the dedicated account |
What not to do to “fix” an SMB scan
Several guides online suggest shortcuts that restore scanning in a few minutes. Each one weakens network security, and the printer is still equipment you should protect like any other.
- Disabling SMB signing. Microsoft advises against this workaround for third-party servers. The same reasoning applies here: signing protects the exchange from being altered in transit.
- Reinstalling SMBv1. Microsoft recommends updating the equipment that requires SMBv1 rather than reinstalling the protocol, which has significant security vulnerabilities.
- Opening the share to “Everyone” with write access, or enabling guest access. Any device on the network could then read or drop files in the folder.
- Saving a personal or administrator account on the printer. The address book keeps these credentials in the device. A dedicated account limits the damage if the device is compromised or replaced.
To go further on protecting scanned and printed documents, read our article on secure printing with Xerox.
When should you switch to another scan method?
If the printer is too old for SMB signing, it is better to change method than to weaken Windows. There are three options:
- Scan to email. Our article on Xerox and Microsoft OAuth 2.0 presents Microsoft’s OAuth 2.0 authentication for scan to email. The one on Xerox scan to email without SMTP describes a secure solution for VersaLink, AltaLink and PrimeLink.
- A file server managed by your IT department. The share no longer depends on a workstation being switched on, but the device must still support the required SMB version and signing.
- A newer multifunction printer, if the device is limited to SMBv1. Browse our A3 and A4 multifunction printers, or read our comparison Xerox vs Lexmark: which professional printer should you choose in 2026? if you are torn between the two brands.
Do you manage several devices and want to avoid reconfiguring each workstation by hand? Our Managed Print Services cover support and fleet management throughout Belgium. For advice on your model, contact D&O Partners.
FAQ: scan to folder on Windows 11
Why does scan to folder no longer work after a Windows 11 update?
Windows 11 24H2 (Pro, Enterprise, Education) requires SMB signing, which also blocks guest access. A printer that cannot sign, or that connects without valid credentials, is refused. Check the firmware and the stored credentials first.
Should I re-enable SMBv1 so an older printer can scan again?
No. SMBv1 is no longer installed by default on Windows 11, and Microsoft recommends updating the equipment that requires it rather than reinstalling the protocol. If the device only supports SMBv1, change the scan method or the device.
Which port should I use for scan to folder on a Xerox?
Port 445, with 139 as an alternative according to the Xerox procedure for VersaLink. The PC’s firewall must also allow this connection.
Can I use my Microsoft account or personal account for scanning?
Xerox accepts a Microsoft account or a local account on the PC hosting the share. We nevertheless recommend a dedicated local account limited to one folder, so that the credentials stored in the device do not give access to the rest of the PC.
How do I know whether SMB signing is required on my PC?
In PowerShell, the command Get-SmbServerConfiguration | FL RequireSecuritySignature returns True if signing is required on this PC, False otherwise. Do not disable it to work around the problem.
Does scan to folder also work on a Lexmark?
Yes, through the Scan to Network Folder application, configured in the Embedded Web Server with an account that has access to the share. Menu labels vary by model.
