Windows 11 File Sharing & Network Shares

File sharing in Windows 11 allows you to share folders and files with other computers on your network. This lesson covers creating shares, managing permissions, and understanding the security implications of network sharing.

Windows 11 File Sharing & Network Shares

Overview

File sharing in Windows 11 allows you to share folders and files with other computers on your network. This lesson covers creating shares, managing permissions, and understanding the security implications of network sharing.

Learning Objectives

  • Create and configure network shares on Windows 11
  • Understand SMB protocol and Windows sharing fundamentals
  • Configure share and NTFS permissions
  • Implement secure sharing practices
  • Troubleshoot common sharing issues

Prerequisites

  • Windows 11 Pro or higher (Home edition has limitations)
  • Administrator access
  • Basic understanding of Windows file system
  • Network connectivity

Core Concepts

What is File Sharing?

File sharing allows multiple users to access files and folders over a network using the SMB (Server Message Block) protocol.

Types of Permissions

1. **Share Permissions**: Control network access to the shared folder 2. **NTFS Permissions**: Control local and network access at the file system level 3. **Effective Permissions**: The most restrictive combination of both

Network Discovery & Sharing Settings

  • **Private Network**: Suitable for home/work networks
  • **Public Network**: Disables sharing for security
  • **Domain Network**: Managed by group policy

Method 1: Basic File Sharing

Step 1: Enable Network Discovery

1. Open **Settings** (Win + I) 2. Navigate to **Network & internet** > **Advanced network settings** 3. Click **Advanced sharing settings** 4. Expand **Private networks** 5. Enable:

  • Network discovery
  • File and printer sharing

Step 2: Share a Folder (GUI Method)

1. Right-click the folder you want to share 2. Select **Properties** 3. Click the **Sharing** tab 4. Click **Share...** 5. Add users:

  • Type username or "Everyone"
  • Set permission level (Read/Write)

6. Click **Share** 7. Note the network path: \\COMPUTERNAME\ShareName

Step 3: Advanced Sharing

1. In folder Properties > **Sharing** tab 2. Click **Advanced Sharing...** 3. Check **Share this folder** 4. Set **Share name** (can differ from folder name) 5. Set **Limit the number of simultaneous users** 6. Click **Permissions** to set share permissions:

  • Everyone: Read (default)
  • Specific users/groups
  • Full Control, Change, or Read

7. Click **OK**

Method 2: PowerShell Sharing

Create a Basic Share

# Create a new share
New-SmbShare -Name "DataShare" -Path "C:\SharedData" -FullAccess "Everyone"

# Create share with specific permissions
New-SmbShare -Name "ProjectFiles" -Path "D:\Projects" `
    -ReadAccess "Domain Users" `
    -ChangeAccess "Project Team" `
    -FullAccess "Administrators"

# Create hidden share (ends with $)
New-SmbShare -Name "Hidden$" -Path "C:\SecretData" -FullAccess "Administrators"

View Existing Shares

# List all shares
Get-SmbShare

# Get details of specific share
Get-SmbShare -Name "DataShare" | Format-List *

# View share permissions
Get-SmbShareAccess -Name "DataShare"

Modify Share Permissions

# Grant permission
Grant-SmbShareAccess -Name "DataShare" -AccountName "DOMAIN\JohnDoe" -AccessRight Full

# Revoke permission
Revoke-SmbShareAccess -Name "DataShare" -AccountName "Everyone"

# Block specific user
Block-SmbShareAccess -Name "DataShare" -AccountName "DOMAIN\BadUser"

Remove a Share

Remove-SmbShare -Name "DataShare" -Force

Method 3: Command Line (NET SHARE)

Create Shares

:: Basic share
net share DataShare=C:\SharedData /grant:everyone,READ

:: Multiple permissions
net share ProjectShare=D:\Projects /grant:Administrators,FULL /grant:Users,READ

:: Hidden administrative share
net share SecretData$=C:\Confidential /grant:Administrators,FULL

View Shares

:: List all shares
net share

:: View specific share details
net share DataShare

Delete Shares

net share DataShare /delete

Security Best Practices

1. Principle of Least Privilege

# Bad practice
New-SmbShare -Name "CompanyData" -Path "C:\Data" -FullAccess "Everyone"

# Good practice
New-SmbShare -Name "CompanyData" -Path "C:\Data" `
    -ReadAccess "Domain Users" `
    -ChangeAccess "Data Managers" `
    -FullAccess "Administrators"

2. Use NTFS Permissions

# Set NTFS permissions in addition to share permissions
$acl = Get-Acl "C:\SharedData"
$permission = "DOMAIN\UserGroup","ReadAndExecute","Allow"
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
$acl.SetAccessRule($accessRule)
Set-Acl "C:\SharedData" $acl

3. Enable SMB Encryption

# Require encryption for a share
Set-SmbShare -Name "SecureShare" -EncryptData $true

# Enable SMB encryption globally
Set-SmbServerConfiguration -EncryptData $true

4. Audit Access

# Enable auditing
auditpol /set /subcategory:"File Share" /success:enable /failure:enable

# View audit events
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=5140}

5. Disable SMB 1.0

# Check SMB version
Get-SmbServerConfiguration | Select EnableSMB1Protocol

# Disable SMB 1.0
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

Accessing Shared Folders

Method 1: File Explorer

1. Open File Explorer 2. Type in address bar: \\ComputerName or \\IPAddress 3. Enter credentials if prompted 4. Browse available shares

Method 2: Map Network Drive

# Map drive with PowerShell
New-PSDrive -Name "Z" -PSProvider FileSystem -Root "\\Server\Share" -Persist

# Map with credentials
$cred = Get-Credential
New-PSDrive -Name "Z" -PSProvider FileSystem -Root "\\Server\Share" `
    -Credential $cred -Persist

Method 3: Command Line

:: Map drive
net use Z: \\Server\Share

:: Map with credentials
net use Z: \\Server\Share /user:DOMAIN\Username Password

:: Map with persistent connection
net use Z: \\Server\Share /persistent:yes

Administrative Shares

Windows creates hidden administrative shares automatically:

  • **C$, D$, etc.**: Root of each drive
  • **ADMIN$**: Windows directory
  • **IPC$**: Inter-process communication
  • **PRINT$**: Printer drivers

Access example:

# Access administrative share (requires admin rights)
Get-ChildItem "\\RemotePC\C$\Windows"

Troubleshooting Common Issues

1. Cannot Access Share

# Check if SMB is enabled
Get-SmbServerConfiguration

# Test connectivity
Test-NetConnection -ComputerName "ServerName" -Port 445

# Check Windows Firewall
Get-NetFirewallRule | Where DisplayName -like "*File and Printer Sharing*"

2. Permission Denied

# View effective permissions
Get-SmbShareAccess -Name "ShareName"

# Check NTFS permissions
Get-Acl "C:\SharedFolder" | Format-List

3. Network Discovery Not Working

# Start required services
Start-Service -Name "FDResPub"
Start-Service -Name "SSDPSRV"
Start-Service -Name "upnphost"

# Check service status
Get-Service -Name "FDResPub", "SSDPSRV", "upnphost", "LanmanServer"

4. SMB Issues

# Reset SMB configuration
Set-SmbServerConfiguration -EnableSMB2Protocol $true
Restart-Service LanmanServer

# View SMB connections
Get-SmbConnection

# View SMB sessions
Get-SmbSession

Practical Exercises

Exercise 1: Create a Department Share

Create a share for the HR department with appropriate permissions:

# Create folder
New-Item -Path "C:\Shares\HR" -ItemType Directory

# Create share
New-SmbShare -Name "HR_Docs" -Path "C:\Shares\HR" `
    -FullAccess "DOMAIN\HR Managers" `
    -ChangeAccess "DOMAIN\HR Staff" `
    -ReadAccess "DOMAIN\Executives"

# Set description
Set-SmbShare -Name "HR_Docs" -Description "Human Resources Documents"

Exercise 2: Secure Financial Share

Create a hidden, encrypted share for financial data:

# Create hidden share with encryption
New-SmbShare -Name "Finance$" -Path "C:\Shares\Finance" `
    -FullAccess "DOMAIN\CFO", "DOMAIN\Finance Managers" `
    -EncryptData $true

# Enable access-based enumeration
Set-SmbShare -Name "Finance$" -FolderEnumerationMode AccessBased

Exercise 3: Monitor Share Access

# View active sessions
Get-SmbSession | Select ClientComputerName, ClientUserName, NumOpens

# View open files
Get-SmbOpenFile | Select ClientComputerName, ClientUserName, Path

# Monitor in real-time
while ($true) {
    Clear-Host
    Write-Host "=== SMB Sessions ===" -ForegroundColor Green
    Get-SmbSession | Format-Table
    Write-Host "`n=== Open Files ===" -ForegroundColor Yellow
    Get-SmbOpenFile | Format-Table
    Start-Sleep -Seconds 5
}

Exercise 4: Backup Share Configurations

# Export share configurations
Get-SmbShare | Export-Csv -Path "C:\Backup\Shares.csv"
Get-SmbShareAccess | Export-Csv -Path "C:\Backup\SharePermissions.csv"

# Restore shares from backup
Import-Csv "C:\Backup\Shares.csv" | ForEach-Object {
    New-SmbShare -Name $_.Name -Path $_.Path
}

Advanced Topics

Access-Based Enumeration (ABE)

Hides files/folders users don't have permission to access:

Set-SmbShare -Name "SharedDocs" -FolderEnumerationMode AccessBased

VSS Shadow Copies

Enable Previous Versions for share recovery:

vssadmin add shadowstorage /for=C: /on=C: /maxsize=10GB
vssadmin create shadow /for=C:

DFS (Distributed File System)

# Install DFS
Install-WindowsFeature FS-DFS-Namespace, FS-DFS-Replication

# Create DFS namespace
New-DfsnRoot -Path "\\Domain\Public" -TargetPath "\\Server1\Public" -Type DomainV2

Security Checklist

  • [ ] Network discovery only on private networks
  • [ ] Use specific user/group permissions (not Everyone)
  • [ ] Enable SMB encryption for sensitive data
  • [ ] Disable SMB 1.0
  • [ ] Regular audit of share permissions
  • [ ] Use hidden shares for administrative access
  • [ ] Implement access-based enumeration
  • [ ] Monitor share access logs
  • [ ] Use strong passwords for share access
  • [ ] Regular backup of share configurations

Common PowerShell Commands Reference

# Share Management
Get-SmbShare                    # List shares
New-SmbShare                    # Create share
Set-SmbShare                    # Modify share
Remove-SmbShare                 # Delete share

# Permissions
Grant-SmbShareAccess           # Add permissions
Revoke-SmbShareAccess          # Remove permissions
Block-SmbShareAccess           # Deny access
Get-SmbShareAccess             # View permissions

# Sessions & Files
Get-SmbSession                 # View sessions
Close-SmbSession               # Disconnect user
Get-SmbOpenFile                # View open files
Close-SmbOpenFile              # Close open file

# Configuration
Get-SmbServerConfiguration     # View SMB config
Set-SmbServerConfiguration     # Modify SMB config
Get-SmbClientConfiguration     # Client settings

Key Takeaways

1. Always use the principle of least privilege 2. Combine share and NTFS permissions for defense in depth 3. Regularly audit and monitor share access 4. Keep SMB protocol updated and secure 5. Document share structures and permissions 6. Test permissions from a user perspective 7. Implement encryption for sensitive data 8. Maintain backups of share configurations

Additional Resources