How to Require SMB Encryption on a Windows Server Share
Applies to: Windows Server 2019, 2022 and 2025.
SMB encryption protects file traffic in transit without requiring IPsec. It can be enabled per share or server-wide after testing client compatibility and performance.
Storage changes can cause data loss or access outages. Use tested backups, maintenance windows and representative access tests. Managed Windows VPS services are available at networkmanager.info.
Prerequisites
- Confirm clients support SMB encryption.
- Measure workload and CPU headroom.
- Record the current share setting.
- Use modern SMB versions and disable SMB1 separately.
Procedure
Step 1: Inspect share
Read current encryption state.
Get-SmbShare -Name Finance | Select Name,Path,EncryptDataStep 2: Enable per-share encryption
Require encryption for this share.
Set-SmbShare -Name Finance -EncryptData $true -ForceStep 3: Review SMB server settings
Confirm protocol configuration.
Get-SmbServerConfiguration | Select EnableSMB1Protocol,EnableSMB2Protocol,EncryptDataStep 4: Test a client connection
Reconnect from an approved client.
Step 5: Inspect session dialect and encryption
Review active sessions.
Get-SmbSession | Select ClientComputerName,Dialect,Encrypted,NumOpensVerification
Active sessions to the protected share should report encryption.
Get-SmbShare -Name Finance | Select Name,EncryptData
Get-SmbSession | Select ClientComputerName,Dialect,EncryptedRollback and recovery
Set-SmbShare -Name Finance -EncryptData $false -Force only after a security-approved rollback decision.
Operational notes
Encryption does not replace NTFS permissions, authentication, backup or endpoint security.
