How do I configure and secure SMB file shares on Windows Server?

Configure and secure SMB file shares on Windows Server with these steps.

---

1. Configure SMB File Shares

Step 1: Create the File Share

1. Log in to the Windows Server with an account that has administrative privileges.
2. Create a folder to share. Navigate to the target directory, right-click the folder, select Properties, then go to the Sharing tab.
3. Click Advanced Sharing.
4. Check Share this folder.
5. Specify a Share Name.
6. Click Permissions and configure access levels:
   • Full Control: Users can read, modify, and delete files.
   • Change: Users can read, modify, and delete files.
   • Read: Users can only view files.
7. Add specific users or groups for granular control.

Step 2: Configure NTFS Permissions

1. Go to the Security tab in the folder properties.
2. Set NTFS permissions to define who can access the files and what they can do.
3. Assign Read, Write, Modify, or Full Control to specific users or groups.
4. Ensure NTFS permissions align with share permissions for consistency.

Step 3: Configure Access-Based Enumeration (Optional)

• Access-Based Enumeration (ABE) hides files and folders from users who lack permissions.
• Open Server Manager, navigate to the File and Storage Services role, and select your shared folder.
• Enable Access-Based Enumeration under the share properties.

Step 4: Test the File Share

• From a client machine, access the share (e.g., \\server-name\share-name) to verify connectivity and permissions.

---

2. Secure SMB File Shares

Step 1: Disable SMBv1

• SMBv1 is outdated and vulnerable. Disable it:
• Open PowerShell as Administrator.
• Run:
  powershell
Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol

Step 2: Restrict Access

1. Use Active Directory groups to manage access instead of individual user accounts.
2. Apply the principle of Least Privilege: grant only the permissions each user needs.

Step 3: Enable Encryption for SMB

• SMB encryption protects data in transit.
• Enable server-wide encryption in PowerShell:
  powershell
Set-SmbServerConfiguration -EncryptData $true
• Or enable encryption on a specific share:
  powershell
Set-SmbShare -Name "ShareName" -EncryptData $true

Step 4: Firewall Configuration

• Configure Windows Defender Firewall to allow SMB traffic (TCP 445) but restrict access to specific IP addresses or subnets where possible.
• Create inbound rules for TCP 445.

Step 5: Audit File Access

• Enable auditing to track access to shared files and folders.
• Open the folder’s Properties, go to the Security tab, and click Advanced.
• Click Auditing, add users or groups to audit, and specify the actions (read, write, etc.) to monitor.
• Review logs in Event Viewer for unauthorized access attempts.

Step 6: Regular Updates

• Keep Windows Server updated with the latest security patches to mitigate SMB vulnerabilities.

Step 7: Implement Antivirus and Endpoint Protection

• Scan the server and shared files regularly with an antivirus or endpoint protection solution.

---

3. Additional Recommendations

• Backup: Regularly back up shared files to protect against accidental deletion or ransomware.
• Use DFS (Distributed File System): Consider DFS namespaces for better management of file shares.
• Monitor Network Activity: Use tools like Microsoft Defender for Endpoint or Sysmon to monitor SMB traffic for suspicious activity.
• Limit Concurrent Access: If necessary, configure throttling to limit concurrent connections.