SMB (Server Message Block) is the Windows file sharing protocol, behind \\server\share paths and mapped network drives. Windows Server makes it easy to share folders with users and other servers. On an internet-facing VPS, though, SMB needs care: it should never be exposed directly to the internet.

Security first: never open port 445 publicly

SMB (TCP 445) is one of the most attacked services on the internet (WannaCry and many others spread through it). Many ISPs block it anyway. For a VPS:

  • keep 445 closed in Windows Firewall for public networks;
  • access shares only over a VPN (WireGuard, Tailscale, or Windows’ built-in VPN), or between servers on a private network;
  • or use SMB over QUIC (Windows Server 2025, and 2022 Azure Edition), which runs over UDP 443 with TLS. It’s designed for internet access without a VPN.

See Tailscale and Windows Server 2025: what’s new.

Create a share (PowerShell)

New-Item -Path D:\Shares\Projects -ItemType Directory
New-SmbShare -Name "Projects" -Path "D:\Shares\Projects" -FullAccess "Administrators" -ChangeAccess "VPS\ProjectTeam" -ReadAccess "VPS\Auditors"
Get-SmbShare

(Replace VPS with your server name, or the domain name.)

Or GUI: right-click the folder → Properties → Sharing → Advanced Sharing.

Share permissions vs NTFS permissions

Two layers apply, and the most restrictive wins:

Layer Controls Typical setting
Share permissions Access over the network Authenticated Users: Change (or specific groups)
NTFS permissions Access to files and folders (local and network) Fine-grained, per group

A common practice: keep share permissions broad (for example Authenticated Users: Change), and control access precisely with NTFS permissions:

icacls D:\Shares\Projects /grant "VPS\ProjectTeam:(OI)(CI)M"
icacls D:\Shares\Projects /grant "VPS\Auditors:(OI)(CI)RX"
icacls D:\Shares\Projects

Create users and groups first. See Windows Server users and groups.

Firewall: allow SMB only from trusted networks

# allow SMB only from the VPN subnet
New-NetFirewallRule -DisplayName "SMB from VPN" -Direction Inbound -Protocol TCP -LocalPort 445 -RemoteAddress 100.64.0.0/10 -Action Allow
Get-NetFirewallRule -DisplayGroup "File and Printer Sharing" | Select-Object DisplayName, Enabled, Profile

Make sure the built-in “File and Printer Sharing” rules aren’t enabled for the Public profile. See Windows Server firewall with PowerShell.

Harden SMB

Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force       # SMB1 is obsolete and insecure
Set-SmbServerConfiguration -RequireSecuritySignature $true -Force  # signing (default on 2025)
Set-SmbShare -Name "Projects" -EncryptData $true -Force            # encrypt traffic for this share
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol, EnableSMB2Protocol, RequireSecuritySignature, EncryptData

Access-based enumeration hides folders users can’t open:

Set-SmbShare -Name "Projects" -FolderEnumerationMode AccessBased -Force

Connect from clients

New-PSDrive -Name P -PSProvider FileSystem -Root \\10.0.0.10\Projects -Persist -Credential (Get-Credential)
# or
net use P: \\10.0.0.10\Projects /user:VPS\alice /persistent:yes

macOS: Finder → Go → Connect to Server → smb://10.0.0.10/Projects. Linux: mount -t cifs or a file manager.

Monitoring and auditing

Get-SmbSession              # who's connected
Get-SmbOpenFile             # which files are open
Close-SmbOpenFile -FileId <id> -Force

Enable object access auditing if you need to know who changed or deleted files.

Alternatives for internet-facing file access

If people need files from anywhere without a VPN, consider SFTP (OpenSSH), or a web-based file platform such as Nextcloud. See OpenSSH on Windows, SFTPGo, and Nextcloud.

Quick reference

Task Command
Create share New-SmbShare -Name X -Path D:\X -ChangeAccess group
NTFS rights icacls D:\X /grant "group:(OI)(CI)M"
Disable SMB1 Set-SmbServerConfiguration -EnableSMB1Protocol $false
Encrypt share Set-SmbShare -Name X -EncryptData $true
Port 445/tcp — VPN or private network only

Related: Windows Server Backup and Windows VPS.

  • Windows Server
  • SMB
  • File Sharing