You should now see a list of all available SMB shares on the server.įrom here right click the share in question and select properties.

To encrypt an SMB share through the GUI, simply open Server Manager > File and Storage Services > Shares. Through the graphical user interface we can only encrypt SMB shares on a per share basis, which is not as powerful as setting it as the default server wide as we did above with PowerShell. While in general it’s best practice to enable encryption globally, you may have instances where you have SMB clients that don’t have support for the encryption so these shares may not be able to use this. Note that if you use PowerShell to enable encryption on a per SMB share basis in this manner and you have the GUI open at the same time (as covered below), you’ll need to refresh the GUI for it to update and correctly display that the share is indeed encrypted. This is similar to the above, but done instead with the Set-SmbShare cmdlet, followed by the name of the share as shown below. If we don’t want to enable SMB encryption server-wide, we can instead only specify a specific share that should be encrypted. Then if we run Get-SmbServerConfiguration again, we should see that EncryptData is now set to true. We can modify this with the Set-SmbServerConfiguration Powershell cmdlet by setting EncryptData to 1 for true. If we run the Get-SmbServerConfiguration cmdlet as shown below, we can see that EncryptData is set to false. With PowerShell we can modify the global server SMB configuration to enable encryption. For more related posts and information check out our full 70-744 study guide. This post is part of our Microsoft 70-744 Securing Windows Server 2016 exam study guide series. We’ll be showing you how to enable SMB encryption on an existing SMB file share in these examples using both PowerShell and the GUI in Windows Server 2016. When creating an SMB share either with PowerShell or through the graphical user interface (GUI) we have the option to enable SMB encryption on the share. By enabling SMB encryption on SMB shares this can be prevented. By default data transferred over the network to an SMB share is in plain text, meaning that an attacker with access to the network can view the files being transferred.

Windows 10 encrypt folder greyed out