Synology Share Says "Network Password Is Not Correct" (System Error 86)? Check Auto Block

Short answer: if Windows keeps saying "The specified network password is not correct" when you map a drive to a Synology NAS, and you're sure the password is right, check whether DSM's Auto Block has blocked your PC's IP address. In DSM go to Control Panel > Security > Protection > Allow/Block List, open the Block List, and remove your IP. A blocked IP gets the same "wrong password" error as a real wrong password, so it looks like a Windows problem when it isn't.

That was the cause for a client of mine. Below is what it looked like, what didn't fix it, and how to unblock without switching protection off for everyone.

The symptom

My client's office uses a Synology NAS as the file server, with a shared folder that staff map as a network drive using a NAS username and password. They had run that setup for years without trouble. Then, fairly suddenly, every Windows 10 and 11 PC refused to connect. Because it started recently, a Windows update was my first suspect.

Windows asked for credentials as usual:

Entering the correct username and password gave this:

Mapping the drive from the command prompt failed the same way, with error 86:

Copy C:\>net use h: \\demoserver\data /user:demouser <password>
System error 86 has occurred.

The specified network password is not correct.

(demoserver and demouser stand in for the real names.)

What didn't work: changing the LAN Manager authentication level

A lot of advice online for this error says to change the NTLM settings in Local Security Policy:

1. Run secpol.msc.
2. Go to Local Policies > Security Options > Network security: LAN Manager authentication level.
3. Set it to Send NTLMv2 response only. Refuse LM & NTLM.

That setting is worth having anyway: it's the secure option, and current Synology DSM supports NTLMv2. But it didn't fix this problem. Neither did other values such as Send LM & NTLM - use NTLMv2 session security if negotiated. Don't leave a weaker setting in place if it doesn't help. Allowing LM or NTLMv1 makes password hashes easier to crack. None of the other fixes I found online worked either, because the problem wasn't on the Windows side.

The cause: Synology Auto Block

DSM has a protection feature called Auto Block. It blocks an IP address once it reaches a set number of failed sign-ins within a time window. This applies to file services like SMB as well as the DSM login. Someone had tried to map the drive with the wrong password too many times, and the NAS blocked the IP.

Once an IP is blocked, the NAS rejects every sign-in from it, including ones with the right password, and Windows reports it as a wrong password. That's why correct credentials kept failing.

Here's the setting, in Control Panel > Security > Protection:

This screenshot was taken after the fix, so Enable auto block is unticked. Note the values shown: 10 failed attempts within 5 minutes triggers a block, and Enable block expiration is off. With expiration off, a blocked IP stays blocked until someone removes it by hand. It won't clear itself overnight.

For this client I turned Auto Block off, and the PCs could map the drive straight away. That was acceptable here because the NAS has other security measures in place. Most people should use one of the fixes below instead.

How to fix it without turning off Auto Block

An earlier version of this post only said to disable Auto Block. That works, but it removes brute-force protection for every service on the NAS. That matters most if DSM, QuickConnect or any file service can be reached from the internet. These fixes are better:

1. Remove the blocked IP. Go to Control Panel > Security > Protection, click Allow/Block List, open the Block List tab, select the PC's IP address and delete it. The PC can connect again straight away.
2. Add your LAN to the Allow List. On the Allow List tab, add your office subnet (for example 192.168.1.0/24) or the specific PCs. Addresses on the Allow List are never auto-blocked, so typos inside the office won't lock anyone out. Attempts from outside are still blocked.
3. Turn on block expiration. Tick Enable block expiration and set Unblock after (days) so a block clears itself instead of lasting until someone notices.
4. Find out where the failed logins came from. One PC with an old saved password (in Windows Credential Manager, a mapped drive set to reconnect at sign-in, or a scanner or backup job) can retry in the background and hit the limit again. DSM's Log Center and notifications show which IP was blocked.

To confirm a block before changing anything, look in the Block List for the PC's IP. You can also try the same credentials from a device with a different IP, such as a phone using a file manager app, or a laptop on the same Wi-Fi. If that works and the PC doesn't, the IP is blocked.

Other causes of System error 86

If your IP isn't in the Block List, these are the usual suspects:

One more tip: avoid typing the password on the net use command line, because it ends up in your command history. Use * and Windows will prompt for it:

Copy net use H: \\demoserver\data /user:demoserver\demouser * /persistent:yes

Credits

Photo by Johnyvino on Unsplash