Sets the Server Message Block (SMB) server configuration.
Networking / Security · Risk: High · Documentation Verified
Last verified: 2026-10-26
Microsoft SmbShare reference: Sets the Server Message Block (SMB) server configuration. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.
Use an account with the target resource permissions documented for Set-SmbServerConfiguration. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.
Supported environments
Windows / SmbShare · Windows Server 2025 documentation; feature/module prerequisites apply
Parameters
-AnnounceComment
Specifies the announce comment string.
-AnnounceServer
Indicates that this server announces itself by using browser announcements.
-AsJob
Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete.
-AsynchronousCredits
Specifies the asynchronous credits.
-AuditClientCertificateAccess
Enables SMB over QUIC client access control audit events. There are three possible events: access allowed, access denied, and error. The access allowed and access denied events list properties of the client certificate chain and any allow and deny access control entries that apply to the client certificates.
-AuditClientDoesNotSupportEncryption
Enables auditing of SMB clients that don't support encryption. Clients that connect and don't list SMB encryption in their supported capabilities will be recorded in the Windows event log.
-AuditClientDoesNotSupportSigning
Enables auditing of the clients attempts to connect without signing to the server. The server logs an audit event when a client attempts to connect to the server without using message signing.
-AuditInsecureGuestLogon
Specifies whether to audit insecure guest logon attempts. When enabled insecure guest logons will appear in Windows Event Viewer.
-AuditSmb1Access
Enables the auditing of SMB version 1 protocol behavior.
-AutoDisconnectTimeoutInMinutesV1
Specifies the v1 auto disconnect time-out period, in minutes.
-AutoDisconnectTimeoutInSecondsV2
Specifies the v2 auto disconnect time-out period, in seconds.
-AutoShareServer
Indicates that the default server shares are shared out.
-AutoShareWorkstation
Indicates whether the default workstation shares are shared out.
-CachedOpenLimit
Specifies the maximum number of cached open files.
-CimSession
Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a New-CimSession or Get-CimSession cmdlet. The default is the current session on the local computer.
Prerequisites
Windows with the SmbShare module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.
Security considerations
This cmdlet changes system state. Review every target and parameter in the official reference, test outside production, and prepare an appropriate backup or rollback. Do not execute the example automatically.
This command sets the SMB Service configuration without user confirmation. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.
Prompts you for confirmation before running the cmdlet.
-DisableCompression
Indicates that the SMB server should never compress files even if client or application requested it.
-DisableSmbEncryptionOnSecureConnection
Specifies that SMB encryption will also be used if configured on the SMB server. By default, QUIC encryption only is used in order to avoid double encryption affecting performance unnecessarily. If a client requires SMB encryption using Set-SmbClientConfiguration -ForceSMBEncryptionOverQuic $true then the DisableSmbEncryptionOnSecureConnection value is ignored and SMB encryption occurs.
-DurableHandleV2TimeoutInSeconds
Specifies the durable handle v2 time-out period, in seconds.
-EnableAuthenticateUserSharing
Indicates whether authenticate user sharing is enabled.
-EnableDirectoryHandleLeasing
Enables directory handle leasing on the server. When directory handle leasing is enabled, the server can cache directory handles for a longer period of time, which can improve performance for certain workloads. This can be particularly useful in scenarios where there are a large number of directory operations being performed on the server.
-EnableDownlevelTimewarp
Indicates whether down-level timewarp support is disabled.
-EnableForcedLogoff
Indicates whether forced logoff is enabled.
-EnableLeasing
Indicates whether leasing is disabled.
-EnableMailslots
Specifies whether to enable mailslots. If this parameter is specified, mailslots will be enabled. Beginning with Windows Server 2025 and Windows 11 Insider Preview Build 25314, remote mailslots are disabled by default. To learn more about remote mailslot deprecation, see Features removed or no longer developed starting with Windows Server 2025.
-EnableMultiChannel
Indicates whether multi-channel is disabled.
-EnableOplocks
Indicates whether the opportunistic locks are enabled.
-EnableSMB1Protocol
Indicates whether the SMB1 protocol is enabled.
-EnableSMB2Protocol
Indicates whether the SMB2 protocol is enabled.
-EnableSMBQUIC
Indicates whether the SMB over QUIC protocol is enabled.
-EnableSecuritySignature
Indicates whether the security signature is enabled.
-EnableStrictNameChecking
Indicates whether the server should perform strict name checking on incoming connects.
-EncryptData
Indicates whether the sessions established on this server are encrypted.
-EncryptionCiphers
Specifies the encryption ciphers used by the SMB server and the preferred order.
-Force
Forces the command to run without asking for user confirmation.
-InvalidAuthenticationDelayTimeInMs
Specifies the length of time in milliseconds that the server should delay before responding to an authentication request that has been deemed invalid, such as an incorrect user name or password.
-IrpStackSize
Specifies the default IRP stack size.
-KeepAliveTime
Specifies the keep alive time.
-MaxChannelPerSession
Specifies the maximum channels per session.
-MaxMpxCount
Specifies the maximum MPX count for SMB1.
-MaxSessionPerConnection
Specifies the maximum sessions per connection.
-MaxThreadsPerQueue
Specifies the maximum threads per queue.
-MaxWorkItems
Specifies the maximum SMB1 work items.
-NullSessionPipes
Specifies the null session pipes.
-NullSessionShares
Specifies the null session shares.
-OplockBreakWait
Specifies how long the create caller waits for an opportunistic lock break.
-PendingClientTimeoutInSeconds
Specifies the pending client time-out period, in seconds.
-RejectUnencryptedAccess
Indicates whether the client that doesn't support encryption is denied access if it attempts to connect to an encrypted share.
-RequestCompression
Indicates if SMB server should always request compression even if client or application didn't specify it.
-RequireSecuritySignature
Indicates whether the security signature is required.
-RestrictNamedpipeAccessViaQuic
Specifies that named pipes are allowed when using SMB over QUIC. A value of $true prevents use of named pipes and is the default.
-ServerHidden
Indicates whether the server announces itself.
-Smb2CreditsMax
Specifies the maximum SMB2 credits.
-Smb2CreditsMin
Specifies the minimum SMB2 credits.
-Smb2DialectMax
This parameter specifies the maximum version of the SMB protocol to be used. Acceptable values are: - None – There is no maximum protocol version specified, the server can use any supported version. - SMB202 – SMB 2.0.2 is the maximum version accepted by the SMB Server - SMB210 - SMB 2.1.0 is the maximum version accepted by the SMB Server - SMB300 - SMB 3.0.0 is the maximum version accepted by the SMB Server - SMB302 - SMB 3.0.2 is the maximum version accepted by the SMB Server - SMB311 - SMB 3.1.1 is the maximum version accepted by the SMB Server
-Smb2DialectMin
This parameter specifies the minimum version of the SMB protocol to be used. Acceptable values are: - None – There is no minimum protocol version specified, the server can use any supported version. - SMB202 – SMB 2.0.2 is the minimum version accepted by the SMB Server - SMB210 - SMB 2.1.0 is the minimum version accepted by the SMB Server - SMB300 - SMB 3.0.0 is the minimum version accepted by the SMB Server - SMB302 - SMB 3.0.2 is the minimum version accepted by the SMB Server - SMB311 - SMB 3.1.1 is the minimum version accepted by the SMB Server
-SmbServerNameHardeningLevel
Controls the level of validation that a server performs on the service principal name (SPN) that is provided by the client device when the client establishes a session using Server Message Block (SMB). The acceptable values are: - 0: Don't enforce SPN check. - 1: Allow clients who didn't provide the target, but fail those who do provide the target and it doesn't match. - 2: Only allow clients who supply matching targets.
-ThrottleLimit
Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.
-TreatHostAsStableStorage
Indicates whether the host is treated as the stable storage.
-ValidateAliasNotCircular
Indicates whether the aliases that aren't circular are validated.
-ValidateShareScope
Indicates that the existence of share scopes is checked during share creation.
-ValidateShareScopeNotAliased
Indicates whether the share scope being aliased is validated.
-ValidateTargetName
Indicates whether the target name is validated.
-WhatIf
Shows what would happen if the cmdlet runs. The cmdlet isn't run.