https://www.samba.org/samba/docs/using_samba/ch09.html

you can configure a share using guest ok = yes to allow access to guest users.

This works only when using share-level security

when needing info on something, consider going to the source rather than some other website, here is the table of contents to samba: https://www.samba.org/samba/docs/using_samba/toc.html

you are using

[GLOBAL]
security = user

which is the most restrictive, and for anyone from a Microsoft Windows system to even access any samba share from your linux system they will need to either have or know an account on that linux system, and then know the password.

part of my smb.conf is this

[global]
        workgroup = WORKGROUP
        passdb backend = tdbsam
        security=user
        map to guest = Bad User
#       map to guest = nobody
        usershare allow guests = No
        server signing = auto

similiar to yours, the above will cause anyone on a windows system who does not have an account on the linux system to never connect, microsoft windows will respond with cannot access \\whatever_server_you_typed. This is because Map to Guest = Bad User where "Bad User" does not exist on the linux system as a user account, it is also syntactically invalid because it has a space.

Using Map to Guest = nobody where nobody however is a valid linux account will result in microsoft windows prompting for a username and password, and this will happen when the given username from microsoft windows is not also a username on the linux system running samba-server.

If you choose this method under Security = User you can use the method i described above to potentially satisfy your security needs. Otherwise you would need to do security = share to accomplish what you initially asked to do- where anyone on the network can access a specific folder without being prompted for a password.

For Security the choices are User, Share, Server, and Domain. The samba help documents will describe what functionality is and is not available under each.

And I recommend you undo the guest account = root

I did not track down the guest account = option in the help docs, I assume it is the same as Map to Guest (just like the Public option is really Guest OK = yes) and for obvious security implications you don't want to map some unknown user to the root account.

OK, I have found an answer myself.

As this is absolutely not obvious from the docs and HOWTOs and whatever, the reason this thing asks for password is because it cannot map guest user to the owner of the directory being shared.

I have NTFS partitions which I need to mount RW so I used the following setup in my /etc/fstab:

/dev/sdb1  /media/disk1  ntfs defaults,noexec,noatime,relatime,utf8,uid=1000,gid=1000 0       2
/dev/sdb2  /media/disk2  ntfs defaults,noexec,noatime,relatime,utf8,uid=1000,gid=1000 0       2

The most important pieces of config are uid and gid (maybe only uid, don't know). They are set to the UID and GID of the user jonnie set up on the server (obviously not root). So, when ntfs-3g will mount these disks, everything will be owned by him.

After that, I have added this user to the Samba registry (or maybe created new identical one, don't care):

# smbpasswd -a jonnie

It asked for password, I have entered the same as for the main system.

After that, I have added the force user and force group settings to the smb.conf:

[global]
  workgroup = WORKGROUP
  netbios name = HOMESERV
  security = user
  map to guest = Bad User

[disk1]
  comment = Disk 1 on 400GB HDD
  path = /media/disk1
  browsable = yes
  guest ok = yes
  read only = no
  create mask = 666
  directory mask = 777
  force user = jonnie
  force group = jonnie

[disk2]
  comment = Disk 2 on 400GB HDD
  path = /media/disk2
  browsable = yes
  guest ok = yes
  read only = no
  create mask = 666
  directory mask = 777
  force user = jonnie
  force group = jonnie

So, most important piece of config relevant to me was force user.

Courtesy of the Samba HOWTO

I finally got it to work. Here's what I had to change:

1. Windows 10/11 have disabled the SMB1 protocol for security reasons. This is a good thing. While you can add SMB1 to Windows, as you'll see others suggests in posts, this is very insecure. Instead, we set the samba server to use at least SMB2 with "min protocol = SMB2".
2. By upping the log level, I saw that even with SMB2 enabled, the connections were not using encryption, which causes a rejection. So we add "server smb encrypt = desired".
3. Finally, Windows will send samba the currently logged in user name when it connects. So, for every user name you want to give access to the shares, make sure there is a corresponding user on the Linux system via "sudo useradd [user name]" and in samba "sudo smbpasswd -a [user]; sudo smbpasswd -e [user]".
4. After that's done, the samba server can be restarted with "sudo systemctl restart smbd.service nmbd.service"

The smb.conf is below.

As an aside, if you're having trouble getting Windows to see your samba server, try installing avahi-daemon and wsdd. I needed both for the machine to advertise its name correctly. You can install them with "sudo apt install avahi-daemon wsdd"

FYI: you can have spaces in the names for the shares, but I removed them anyway.

smb.conf:

[global]
   encrypt passwords = yes
   server smb encrypt = desired
   min_protocol = SMB2
   
   workgroup = WorkGroup
   netbios name = sambaserver

   # Uncomment the following line for detailed logs in /var/log/samba
   # log level = 5

   server string = %h server (Samba, Ubuntu)
   wins support = yes
   log file = /var/log/samba/log.%m
   max log size = 1000
   logging = file
   panic action = /usr/share/samba/panic-action %d
   server role = standalone server
   
   obey pam restrictions = yes
   unix password sync = yes

   passwd program = /usr/bin/passwd %u
   passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
   pam password change = yes

   map to guest = bad user

   usershare allow guests = yes


# My file shares!
[public]
  comment = File Server Share
  path = /mypool/shared
  browseable = yes
  guest ok = yes
  read only = no
  create mask = 0755
  force user = nobody

[restricted]
  comment = Restricted Server Share
  path = /mypool/restricted
  browseable = yes
  guest ok = no
  read only = no
  create mask = 0755
  valid users = max

In top menu of the file browser click Go>Location and enter smb://user@host/sharename. You will then be prompted to enter a password.

This was the key option to set to resolve this issue:

[global]
    map to guest = bad user

From:

$ man smb.conf | grep -m1 -B8 -A16 'Bad User'

Bad User - Means user logins with an invalid password are rejected, unless the username does not exist, in which case it is treated as a guest login and mapped into the guest account.