How to Create a Secure SMB Share with PowerShell
Applies to: Windows Server 2019, 2022 and 2025.
A secure share combines share permissions, NTFS permissions and access-based enumeration. Use groups rather than direct user ACLs.
Storage changes can cause data loss or access outages. Use tested backups, maintenance windows and representative access tests. Managed Windows VPS services are available at networkmanager.info.
Prerequisites
- Create role-based read and modify groups.
- Choose a data path and backup policy.
- Confirm no conflicting share name exists.
- Define whether offline files are permitted.
Procedure
Step 1: Create the folder
Use a dedicated data volume.
New-Item -ItemType Directory -Path 'D:\Shares\Finance' -ForceStep 2: Disable inherited NTFS access
Use icacls only after retaining SYSTEM and Administrators recovery access.
icacls 'D:\Shares\Finance' /inheritance:r
icacls 'D:\Shares\Finance' /grant 'SYSTEM:(OI)(CI)F' 'Administrators:(OI)(CI)F' 'CORP\DL-Finance-Share-Modify:(OI)(CI)M'Step 3: Create the share
Grant Full at share level to the resource group and control detail with NTFS.
New-SmbShare -Name 'Finance' -Path 'D:\Shares\Finance' -FullAccess 'CORP\DL-Finance-Share-Modify','BUILTIN\Administrators' -FolderEnumerationMode AccessBasedStep 4: Review configuration
Inspect share and ACLs.
Step 5: Test with standard accounts
Validate permitted and denied scenarios.
Verification
Confirm share path, share permissions and NTFS ACL.
Get-SmbShare -Name Finance
Get-SmbShareAccess -Name Finance
Get-Acl 'D:\Shares\Finance' | Format-ListRollback and recovery
Remove-SmbShare stops sharing without deleting files. Restore the prior ACL from backup or the exported security descriptor if permissions were wrong.
Operational notes
Share and NTFS permissions combine; the most restrictive effective result governs network access.
