How to Manage SMB Network Shares in Windows 11 Using PowerShell

In Windows 11 environments, sharing folders across local networks allows teams to collaborate on project repositories, media assets, and backups without cloud file synchronisation latency. While administrators can configure shared folders through the File Explorer properties sheet, managing shares graphically is slow, lacks version-controlled repeatability, and cannot be integrated into unattended setup scripts.

The native SmbShare module in Windows PowerShell delivers enterprise-grade management of Server Message Block (SMB) network shares. Using dedicated cmdlets like Get-SmbShare, New-SmbShare, and Grant-SmbShareAccess, you can audit, provision, restrict, and tear down network shares in seconds. Here is how to manage SMB network shares in Windows 11 using PowerShell.

Prerequisites: Running Elevated PowerShell

Because creating network shares and altering share permissions modifies system-wide networking boundaries, administrative elevation is required:

1. Right-click the Start menu button on your Windows 11 taskbar (or press Windows Key + X).
2. Select Terminal (Admin) or PowerShell (Admin).
3. When prompted by the User Account Control (UAC) prompt, click Yes.

How to List and Audit Existing SMB Shares

To inspect all active network shares currently hosted by your Windows 11 machine, execute Get-SmbShare:

Get-SmbShare

This command returns a formatted table displaying each share’s name, local file path, and description. You will notice several built-in default administrative shares ending with a dollar sign (such as ADMIN$, C$, and IPC$), which are reserved for system management.

To filter out hidden administrative shares and view only user-created network shares, run:

Get-SmbShare | Where-Object { $_.Special -eq $false }

How to Create a New SMB Network Share

To create a network share, ensure the local directory exists on your storage drive, then execute New-SmbShare:

# Create the local directory if it does not already exist
New-Item -ItemType Directory -Path "C:\Shares\ProjectAssets" -Force

# Create the SMB network share with defined permissions
New-SmbShare -Name "ProjectAssets" -Path "C:\Shares\ProjectAssets" -FullAccess "Administrators" -ReadAccess "Everyone" -Description "Shared project repository for design team"

In this command:

• -Name "ProjectAssets": The network name visible to other computers browsing your PC (e.g. \\YOUR-PC\ProjectAssets).
• -Path "C:\Shares\ProjectAssets": The physical directory path on your local hard drive.
• -FullAccess "Administrators": Grants members of the local Administrators group complete control over the share.
• -ReadAccess "Everyone": Authorises general users on your local network to read and copy files without write permissions.

How to Audit Share Access Permissions

Share permissions determine network access rights across the wire. To review which accounts and security groups have access to a specific share, use Get-SmbShareAccess:

Get-SmbShareAccess -Name "ProjectAssets"

The console lists each user or group’s AccountName, AccessControlType (Allow or Deny), and AccessRight (Read, Change, or Full).

How to Grant, Revoke, or Block Share Access

You can dynamically modify share access without rebuilding the share from scratch:

Granting Additional Permissions

To grant write and modification permissions to a specific user or group, use Grant-SmbShareAccess:

Grant-SmbShareAccess -Name "ProjectAssets" -AccountName "SarahJenkins" -AccessRight Change -Force

Revoking Existing Permissions

To remove an existing permission entry, execute Revoke-SmbShareAccess:

Revoke-SmbShareAccess -Name "ProjectAssets" -AccountName "Everyone" -Force

Explicitly Blocking Access

To explicitly deny access to an individual account (which takes precedence over group allowances), use Block-SmbShareAccess:

Block-SmbShareAccess -Name "ProjectAssets" -AccountName "Guest" -Force

Configuring Advanced Share Settings

Using Set-SmbShare, you can customise technical behavioural flags to enhance security and reduce bandwidth:

• Access-Based Enumeration (ABE): Hides files and sub-folders that a user does not have NTFS read permissions to view, preventing users from seeing files they cannot open:

  Set-SmbShare -Name "ProjectAssets" -FolderEnumerationMode AccessBased

• Offline Caching Modes: Control whether remote Windows clients can cache share contents locally:

  Set-SmbShare -Name "ProjectAssets" -CachingMode None

• Updating Descriptions:

  Set-SmbShare -Name "ProjectAssets" -Description "Engineering production assets"

How to Remove (Unshare) an SMB Network Share

When a project concludes and the network share is no longer required, delete the share mapping using Remove-SmbShare:

Remove-SmbShare -Name "ProjectAssets" -Force

Important: Removing the SMB share deletes only the network broadcast mapping. Your local directory (C:\Shares\ProjectAssets) and all files contained within it remain completely intact on your storage drive.

Understanding Share Permissions vs NTFS File Permissions

A crucial rule of Windows security is that a user’s effective permission over a network share is the most restrictive intersection between Share permissions and local NTFS permissions:

Share Permission	NTFS File Permission	Effective Network Access
Read	Modify	Read Only (constrained by Share permission)
Full Control	Read	Read Only (constrained by NTFS permission)
Change	Modify	Read & Write / Modify

Best practice is to assign Full Control or Change at the SMB share layer and enforce granular security boundaries using local NTFS file permissions on the target directory.