How to Configure SMB over QUIC in Windows 11 Using PowerShell

Server Message Block (SMB) file sharing has traditionally relied on TCP port 445 or NetBIOS transport. While highly effective within local enterprise networks, routing traditional SMB over the public internet exposes organizations to malicious port scanning, brute-force exploits, and network-level eavesdropping. Consequently, most telecommunications providers and enterprise perimeter firewalls categorically block TCP port 445.

To provide secure, high-performance remote file sharing without requiring a complex virtual private network (VPN), Microsoft introduced SMB over QUIC. Operating over UDP port 443 with mandatory TLS 1.3 encryption, SMB over QUIC delivers zero-round-trip-time (0-RTT) handshakes, robust cipher negotiation, and immunity to port 445 filtering. In Windows 11 and Windows Server environments, administrators can configure, inspect, and enforce SMB over QUIC configurations natively using PowerShell.

Prerequisites and Architecture Overview

SMB over QUIC operates as an alternative transport layer for standard SMB 3.1.1 protocol communications. Before deploying or connecting to an SMB over QUIC file share, ensure your infrastructure meets the necessary technical baseline:

• Server Endpoint: Windows Server 2022 Datacenter: Azure Edition or Windows 11 (Insider Preview / Enterprise editions with SMB over QUIC server support enabled).
• Client Endpoint: Windows 11 Pro, Enterprise, or Education editions (Build 22000 or later).
• Transport Layer: UDP port 443 outbound from the client and inbound to the file server host.
• Digital Certificates: A trusted X.509 server certificate issued by a commercial Certificate Authority (CA) or an enterprise internal PKI, configured with Server Authentication (OID 1.3.6.1.5.5.7.3.1).

Clients connecting to an SMB over QUIC endpoint do not send plain authentication requests across the wire; initial connection negotiation occurs inside an encrypted TLS 1.3 tunnel before NTLM or Kerberos authentication tokens are exchanged.

Generating and Binding Certificates for SMB over QUIC

The SMB server requires a cryptographic certificate mapped to its fully qualified domain name (FQDN). For enterprise deployments, obtain a certificate from Active Directory Certificate Services (AD CS) or an external public CA. For lab verification or internal testing, you can generate a self-signed certificate using PowerShell.

Launch an elevated PowerShell session and execute the following commands to generate a testing certificate:

$CertParams = @{
    Subject           = "CN=fileserver.corp.contoso.com"
    DnsName           = "fileserver.corp.contoso.com", "fileserver"
    KeyLength         = 2048
    KeyAlgorithm      = "RSA"
    HashAlgorithm     = "SHA256"
    CertStoreLocation = "Cert:\LocalMachine\My"
    KeyUsage          = "DigitalSignature", "KeyEncipherment"
    Type              = "SSLServerAuthentication"
    NotAfter          = (Get-Date).AddYears(2)
}

$ServerCert = New-SelfSignedCertificate @CertParams
$ServerCert.Thumbprint

To bind this certificate to the SMB server service and enable the QUIC transport listener, use the Set-SmbServerCertificateMapping cmdlet:

New-SmbServerCertificateMapping -Name "fileserver.corp.contoso.com" -Thumbprint $ServerCert.Thumbprint -TransportType QUIC

Verify that the certificate mapping was established successfully:

Get-SmbServerCertificateMapping

Configuring SMB Client Certificate and QUIC Settings in Windows 11

On the Windows 11 client machine, configure the SMB client environment to prioritize QUIC transport when resolving connections to designated remote servers.

First, inspect the active SMB client configuration settings:

Get-SmbClientConfiguration | Select-Object EnableSMBQUIC, AuditClientCertificateValidation, RequireMutualAuthentication

Ensure that the QUIC transport protocol is enabled on the client machine:

Set-SmbClientConfiguration -EnableSMBQUIC $true -Confirm:$false

If you are utilizing a self-signed certificate or private enterprise CA for lab validation, export the public root certificate from the server and install it into the Cert:\LocalMachine\Root store of the Windows 11 client:

# Import root CA certificate on the Windows 11 client
Import-Certificate -FilePath "C:\Certs\CorpRootCA.cer" -CertStoreLocation "Cert:\LocalMachine\Root"

Connecting to an SMB Share over QUIC

In Windows 11, mounting an SMB share over QUIC follows familiar syntax while explicitly enforcing the QUIC transport flag. To map a network drive or establish a session over QUIC via PowerShell, use New-SmbMapping:

New-SmbMapping -LocalPath "Z:" -RemotePath "\\fileserver.corp.contoso.com\Engineering" -TransportType QUIC -UserName "CONTOSO\AdminUser"

Alternatively, if mounting through standard command-line tools such as net use, Windows 11 will automatically attempt QUIC negotiation over UDP 443 if standard TCP 445 connectivity fails:

net use Z: \\fileserver.corp.contoso.com\Engineering /transport:quic

Verifying Connection Transport, Dialect, and Encryption

Once the share is mapped and data transmission commences, confirm that the live connection is traversing the QUIC transport layer rather than falling back to unencrypted or legacy TCP channels.

Execute Get-SmbConnection in PowerShell:

Get-SmbConnection | Format-Table ServerName, ShareName, Dialect, TransportType, NumOpens

The TransportType column must display QUIC, and the Dialect column must display 3.1.1. If the transport shows TCP, check firewall rules and certificate validity.

To inspect active encryption and signing levels enforced across the tunnel, execute:

Get-SmbConnection | Select-Object ServerName, Encrypted, Signed, Cipher

When operating over QUIC, encryption is handled at the TLS 1.3 transport layer, while SMB 3.1.1 AES-128-GCM or AES-256-GCM encryption provides end-to-end payload confidentiality.

Configuring Client Access Control and Certificate Auditing

For zero-trust enterprise deployments, administrators can enforce client certificate validation to ensure that only authorized domain workstations can initiate SMB over QUIC sessions.

To enable client access control restrictions on the SMB server, configure client certificate restrictions:

# Enable SMB client certificate auditing and enforcement
Set-SmbServerConfiguration -AuditClientCertificateValidation $true -Confirm:$false

To configure client access control list (ACL) rules mapping specific client certificate Subject Names or Issuer Thumbprints to authorized SMB shares, use the client certificate mapping cmdlets:

# Map authorized client certificate issuer
New-SmbClientCertificateMapping -Namespace "*.corp.contoso.com" -Thumbprint $ClientCertThumbprint -StoreName "My"

Troubleshooting SMB over QUIC Connectivity

If client connection attempts time out or revert to TCP fallback, examine the following diagnostic points:

• UDP Port 443 Filtering: Verify that intermediate firewalls or cloud security groups allow bidirectional UDP port 443 traffic. Run a PowerShell test:

  Test-NetConnection -ComputerName "fileserver.corp.contoso.com" -Port 443

  Note that Test-NetConnection probes TCP by default; verify UDP connectivity with specialized tooling or packet captures.
• Certificate Subject Mismatch: The hostname requested by the client in the UNC path must exactly match either the Common Name (CN) or a Subject Alternative Name (SAN) entry in the server certificate. Connecting by raw IP address will fail certificate validation.
• Event Log Diagnostics: Inspect SMB and QUIC event logs in the Windows Event Viewer:

  Get-WinEvent -LogName "Microsoft-Windows-SMBClient/Operational" | Where-Object { $_.Id -in 31001, 31002, 31003 } | Select-Object -First 10 | Format-List

  Review events under Microsoft-Windows-SMBServer/Connectivity and Microsoft-Windows-MSQuic for detailed cryptographic handshake error codes.