Troubleshoot Windows SMB File Sharing Safely
When a Windows share fails, identify the failing layer before changing firewall or permissions. A successful TCP connection to the server does not prove the user has both share and NTFS access, and a visible computer in Network does not prove SMB connectivity.
Start with the exact symptom
Record the client, server name, share path, user identity, time of failure, and complete error. Test the hostname and TCP 445 from the client:
Resolve-DnsName fileserver.contoso.com
Test-NetConnection fileserver.contoso.com -Port 445
Test-Path '\\fileserver.contoso.com\Finance'If name resolution fails, investigate DNS and the name being used. If TCP 445 fails, check routing and the server’s inbound firewall policy. If TCP succeeds but Test-Path or opening the share returns access denied, move on to identity and permissions. Do not open SMB to untrusted networks; restrict firewall rules to the required network profiles and source ranges.
Check the server and firewall
On the file server, confirm the share exists and inspect the effective share access entries:
Get-SmbShare -Name 'Finance'
Get-SmbShareAccess -Name 'Finance'
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol, RequireSecuritySignatureEnable only the applicable built-in File and Printer Sharing inbound firewall rules for the intended network profile and management scope. Prefer deploying the rule through the organization’s endpoint firewall policy where devices are centrally managed. Do not enable every profile just to make a test pass.
Keep SMB signing and encryption requirements aligned with organizational policy. Disabling signing can reduce protection against tampering and relay attacks; do not set RequireSecuritySignature to false as a routine troubleshooting step. If a legacy peer cannot connect, identify and upgrade or isolate that peer, then make any temporary exception through an approved, scoped change.
SMB1 is deprecated and should remain disabled unless a documented legacy dependency has been assessed and isolated. SMB2/3 are enabled by default on supported Windows systems; do not turn protocol versions on or off as a guess.
Check both permission layers
Windows access is constrained by the share permissions and the folder’s NTFS permissions. The effective access is the more restrictive combination. Grant access to a specific user or, preferably, a role-based domain group; grant only Read or Change when Full control is not required.
# Inspect the share ACL
Get-SmbShareAccess -Name 'Finance'
# Inspect the backing folder ACL
Get-Acl 'D:\Shares\Finance' | Format-List Owner, AccessAvoid broad entries such as Everyone: Full. If access needs to be granted, identify the approved group and choose the minimum required share right. For example, a group that needs to edit files might receive Change at the share layer while its NTFS ACL is managed separately:
Grant-SmbShareAccess -Name 'Finance' -AccountName 'CONTOSO\Finance-Editors' -AccessRight ChangeReview the existing ACL and change ticket before altering permissions. Do not reset permissions wholesale: that can expose data or break application access.
Network discovery is separate from direct access
If \\server\share works but the computer does not appear under Network, SMB access is working; troubleshoot discovery separately. Network browsing is not a reliable health check for a share. Check the active network profile and the organization-approved Function Discovery firewall and service settings rather than enabling legacy SMB1 or the deprecated Computer Browser service.
Quick decision table
| Evidence | Investigate next |
|---|---|
| DNS lookup fails | DNS record, suffix, or client name resolution |
| TCP 445 fails | Routing, server availability, firewall scope |
| TCP works; access denied | User token, share ACL, NTFS ACL, group membership |
| Direct UNC works; Network list is empty | Discovery settings only |
| Only one client fails | Its DNS cache, route, firewall, credentials, and time |
For the protocol and firewall details, see Microsoft’s SMB signing guidance, SMB file-sharing port guidance, and the New-SmbShare permission reference.