How to Check SMB Encryption in Windows 11

Tuesday, September 29, 2026

Learn how to check SMB encryption in Windows 11 using PowerShell, verify encrypted connections, and troubleshoot SMB security issues.

SMB encryption is an important security feature in Windows 11 that protects data transferred through Server Message Block (SMB) file-sharing connections. If you use shared folders, Windows file servers, NAS devices, or other SMB-compatible systems, checking SMB encryption can help you determine whether network file transfers are protected from interception.

Unlike SMB signing, which focuses primarily on message integrity, SMB encryption provides confidentiality for SMB data traveling between the client and server. This makes it particularly useful when sensitive files are transferred across networks that should not be considered fully trusted.

Windows 11 provides several SMB encryption settings that can be inspected with PowerShell. You can check the SMB server configuration, inspect individual shared folders, and verify whether active SMB connections are encrypted.

In this guide, you will learn how to check SMB encryption in Windows 11 using PowerShell, understand the EncryptData and RejectUnencryptedAccess settings, inspect active SMB connections, check individual shares, troubleshoot encryption compatibility problems, and understand how SMB encryption relates to SMB signing and SMB dialects.

What Is SMB Encryption?

SMB encryption protects SMB data while it travels between an SMB client and server. Microsoft describes SMB Encryption as end-to-end protection against interception and eavesdropping on untrusted networks.

For example, when a Windows 11 computer copies a file from a shared folder on another computer, SMB normally carries the file data over the network. If SMB encryption is required and supported, the SMB traffic is encrypted during transmission.

SMB encryption is different from protecting files stored on a disk. SMB encryption protects data while it is moving across the network. It does not replace at-rest protection such as BitLocker.

SMB Encryption vs SMB Signing

SMB signing and SMB encryption are related security features, but they have different purposes.

Feature	Primary Purpose
SMB Signing	Helps protect SMB message integrity and detect tampering.
SMB Encryption	Protects SMB data from being read during network transmission.
SMB Dialect	Identifies the SMB protocol version negotiated between client and server.

For a complete SMB security assessment, it can therefore be useful to check all three. You can start with our guide on How to Check SMB Signing in Windows 11 and then inspect encryption using the methods in this guide.

Why Should You Check SMB Encryption?

Checking SMB encryption can help when you need to:

Verify whether an active SMB connection is encrypted.
Check whether a Windows 11 file server requires encryption.
Determine whether a specific SMB share requires encryption.
Troubleshoot access problems with older NAS devices.
Investigate SMB security after a Windows update.
Compare SMB security configurations between computers.
Determine whether sensitive network file transfers are protected.

It is especially useful when a connection works on one computer but fails on another, because differences in SMB encryption requirements can be one possible cause.

SMB Encryption Requirements

SMB encryption was introduced with SMB 3.0 and later dialects. Microsoft documents SMB 3.0, SMB 3.0.2, and SMB 3.1.1 as supporting SMB encryption.

This means that an older SMB implementation that only supports SMB 2.x cannot provide SMB encryption.

You can check the negotiated dialect of an active connection with:

Get-SmbConnection | Select-Object ServerName, ShareName, Dialect

If you want a more complete explanation of the Dialect property, see How to Check SMB Dialect in Windows 11.

Before You Start

Most commands in this guide use the built-in SMB PowerShell module in Windows 11.

To inspect SMB configuration, open PowerShell. When you are making configuration changes, use an elevated PowerShell session by selecting Run as administrator.

To open an elevated PowerShell session:

Open the Start menu.
Search for PowerShell.
Right-click Windows PowerShell or Windows Terminal.
Select Run as administrator.
Approve the User Account Control prompt if Windows requests permission.

How to Check SMB Server Encryption in Windows 11

If your Windows 11 computer provides shared folders to other computers, you can check the SMB server configuration with:

Get-SmbServerConfiguration

To focus on encryption-related settings, use:

Get-SmbServerConfiguration | Select-Object EncryptData, RejectUnencryptedAccess

You can also use:

Get-SmbServerConfiguration | Format-List EncryptData, RejectUnencryptedAccess

The two properties are important when troubleshooting SMB encryption.

EncryptData: indicates whether SMB encryption is enabled at the server configuration level.
RejectUnencryptedAccess: controls whether clients that do not support encryption are denied access when encryption is required by the relevant SMB configuration.

Microsoft's troubleshooting documentation specifically recommends checking these settings when investigating SMB Tree Connect failures related to encryption.

How to Check SMB Encryption for a Specific Share

SMB encryption can be configured at the share level. This means that checking only the overall server configuration may not give you the complete picture.

To list SMB shares and their encryption setting, use:

Get-SmbShare | Select-Object Name, Path, EncryptData

You can also inspect one specific share:

Get-SmbShare -Name "Documents" | Format-List *

Look for:

EncryptData : True

A share with EncryptData set to True is configured to use SMB encryption.

Microsoft documents the EncryptData property for SMB shares and supports configuring encryption on an individual share.

Check All SMB Shares for Encryption

If the Windows 11 computer hosts multiple shared folders, checking all of them at once can be useful.

Get-SmbShare | Select-Object Name, Path, EncryptData

The output can look similar to:

Name          Path                 EncryptData
----          ----                 -----------
Documents     C:\Shares\Documents  True
Projects      D:\Projects          False
Media         D:\Media             False

This lets you quickly identify which shares have encryption enabled.

How to Check Whether an Active SMB Connection Is Encrypted

One of the most useful checks is to inspect an active SMB connection from the Windows 11 client.

Run:

Get-SmbConnection

For detailed connection information, use:

Get-SmbConnection | Format-List *

Microsoft's Get-SmbConnection output includes an Encrypted property. This lets you inspect whether a particular SMB connection is using encryption.

For a cleaner result, use:

Get-SmbConnection | Select-Object ServerName, ShareName, UserName, Dialect, Encrypted, NumOpens

For example:

ServerName   ShareName    UserName       Dialect   Encrypted   NumOpens
----------   ---------    --------       -------   ---------   --------
FILESERVER   Documents    HENDRA         3.1.1     True        2
NAS01        Media        HENDRA         3.0       False       1

In this example, the connection to FILESERVER is encrypted, while the connection to NAS01 is not.

The exact output depends on the SMB connections currently established on your computer.

Check a Specific SMB Server

If you have several SMB connections, you can filter the results by server name.

Get-SmbConnection -ServerName "FILESERVER"

For detailed information:

Get-SmbConnection -ServerName "FILESERVER" | Format-List *

Or display only the most useful properties:

Get-SmbConnection -ServerName "FILESERVER" |
Select-Object ServerName, ShareName, Dialect, Encrypted, NumOpens

This is particularly helpful when a Windows 11 computer connects to multiple servers or NAS devices.

How to Check SMB Encryption and SMB Dialect Together

The SMB dialect determines which protocol version the connection negotiated, while the Encrypted property shows whether the connection is encrypted.

Get-SmbConnection |
Select-Object ServerName, ShareName, Dialect, Encrypted

For example:

ServerName   ShareName    Dialect   Encrypted
----------   ---------    -------   ---------
SERVER01     Documents    3.1.1     True
NAS01        Media        3.0       False

This makes it easy to compare SMB protocol versions and encryption status at the same time.

Remember that using a modern SMB dialect does not automatically mean that every connection is encrypted. The encryption status must be checked on the actual connection.

How to Enable SMB Encryption on a Share

If you administer a Windows SMB server and want to enable encryption for a particular share, Microsoft documents the Set-SmbShare command.

Set-SmbShare -Name "Documents" -EncryptData $true

After making the change, verify the share configuration:

Get-SmbShare -Name "Documents" | Select-Object Name, Path, EncryptData

The expected result should show:

EncryptData : True

Use this carefully on production systems because clients that do not support SMB encryption may no longer be able to access a share that requires it.

How to Enable SMB Encryption for the Entire Server

Microsoft also supports enabling SMB encryption at the server level.

Set-SmbServerConfiguration -EncryptData $true

After changing the configuration, verify it with:

Get-SmbServerConfiguration | Select-Object EncryptData, RejectUnencryptedAccess

Microsoft documents Set-SmbServerConfiguration -EncryptData $true as a method for enabling SMB Encryption for the entire file server.

Before applying this to a production server, identify the SMB clients that connect to it and verify that they support SMB 3.0 or later with encryption.

How to Require Encryption for SMB Client Connections

Windows 11 version 24H2 introduced support for requiring encryption for all outbound SMB client connections. Microsoft documents this as a way for administrators to require destination servers to support SMB 3.0 or later and SMB encryption.

This can affect connections to third-party SMB servers, older NAS devices, and other systems that support SMB but do not support encryption.

For Windows 11 24H2 and later, administrators can configure this requirement through the documented SMB client policy and configuration mechanisms.

Before requiring encryption globally, test the setting against all important SMB servers and NAS devices in the environment.

SMB Encryption and Windows 11 24H2

Windows 11 24H2 introduced important changes to SMB security. Microsoft documents the ability for SMB clients to require encryption for all outbound connections, providing a stronger security requirement for network file transfers.

This is important when troubleshooting a system that was upgraded from an earlier Windows release.

A network share that previously worked may behave differently if the client now requires encryption and the remote SMB server does not support it.

If you experience this type of problem, do not immediately disable SMB security. First identify the remote server, check its SMB dialect, verify whether it supports encryption, and inspect the current Windows SMB configuration.

How to Troubleshoot SMB Encryption Problems

If you cannot connect to an SMB share, start by checking the active client configuration:

Get-SmbClientConfiguration | Format-List *

Then inspect the server-side configuration if you administer the server:

Get-SmbServerConfiguration |
Select-Object EncryptData, RejectUnencryptedAccess

Check the share:

Get-SmbShare |
Select-Object Name, Path, EncryptData

Finally, inspect the active connection:

Get-SmbConnection |
Select-Object ServerName, ShareName, Dialect, Encrypted

These four checks can help determine whether the problem is related to the client requirement, server configuration, share configuration, or actual connection capabilities.

Common SMB Encryption Compatibility Problems

Older devices are one of the most common considerations when introducing stronger SMB security requirements.

A NAS device or third-party SMB server may support file sharing but lack SMB encryption support. Microsoft notes that third-party devices may not support SMB encryption, so the device documentation may need to be consulted when troubleshooting compatibility.

Potential compatibility issues include:

The remote device only supports SMB 2.x.
The remote device supports SMB 3.x but not SMB encryption.
The SMB share requires encryption but the client does not support it.
The Windows client requires encryption but the remote server cannot provide it.
A Windows update changes the security requirements of the client.

Checking the SMB dialect and encryption status together is usually more useful than looking at only one setting.

SMB Encryption vs SMB Share Permissions

Encryption does not determine whether a user is authorized to access a folder.

For example, an SMB share can be fully encrypted while a particular user still does not have permission to access it.

SMB encryption protects data during transmission. Share permissions and NTFS permissions determine access to resources.

For more information, see How to Check SMB Share Permissions in Windows 11 and How to Check Shared Folder Permissions in Windows 11.

SMB Encryption and SMB Multichannel

SMB encryption can also be relevant in environments using SMB Multichannel.

SMB Multichannel allows SMB to use multiple network paths when the environment supports them. Encryption is a separate security feature.

You can check active SMB Multichannel connections with:

Get-SmbMultichannelConnection

For a complete explanation, see How to Check SMB Multichannel in Windows 11.

When troubleshooting SMB performance after enabling encryption, remember that Microsoft notes there can be a performance cost associated with end-to-end encryption. Modern Windows and SMB implementations provide hardware and protocol improvements that can reduce this impact, but performance should still be tested in the actual environment.

How to Check SMB Encryption Before Changing Settings

A safe troubleshooting workflow is to inspect the current state before making configuration changes.

Check the SMB client configuration.
Check the SMB server configuration.
Check the share encryption setting.
Check the negotiated SMB dialect.
Check the active connection's Encrypted property.
Check the remote device's SMB capabilities.
Only then consider changing the encryption requirement.

This approach helps avoid changing a security setting when the actual problem is caused by permissions, firewall rules, network discovery, authentication, or an incompatible SMB dialect.

Useful PowerShell Commands

Command	Purpose
`Get-SmbConnection`	View active SMB client connections and encryption status.
`Get-SmbServerConfiguration`	View SMB server encryption configuration.
`Get-SmbShare`	View SMB shares and their encryption settings.
`Get-SmbClientConfiguration`	View SMB client configuration.
`Get-SmbMultichannelConnection`	View SMB Multichannel connections.
`Set-SmbShare`	Modify an SMB share's encryption configuration.
`Set-SmbServerConfiguration`	Modify SMB server configuration.

Frequently Asked Questions

How do I check SMB encryption in Windows 11?

Use Get-SmbConnection | Select-Object ServerName, ShareName, Dialect, Encrypted to inspect active SMB connections and see whether each connection is encrypted.

What does EncryptData mean?

EncryptData indicates whether SMB encryption is enabled for the relevant SMB server or share configuration.

What does RejectUnencryptedAccess mean?

RejectUnencryptedAccess controls whether clients that do not support encryption are rejected when encryption is required by the relevant SMB configuration.

Is SMB encryption the same as SMB signing?

No. SMB signing helps protect message integrity and detect tampering, while SMB encryption protects SMB data from being read during network transmission.

Does SMB encryption work with SMB 2?

SMB encryption was introduced with SMB 3.0. SMB 2.x does not provide the SMB encryption feature.

Can SMB encryption cause connection problems?

Yes. If a Windows client or SMB share requires encryption and the remote SMB server does not support it, the connection can fail.

Can I enable encryption for only one SMB share?

Yes. Windows supports configuring SMB encryption at the individual share level using Set-SmbShare -EncryptData $true.

Does SMB encryption protect files stored on the hard drive?

No. SMB encryption protects data while it is transferred over the network. It does not provide at-rest protection for files stored on disk.

Related Windows 11 SMB Guides

Final Thoughts

Checking SMB encryption in Windows 11 gives you a clearer picture of how network file-sharing traffic is protected. Instead of assuming that an SMB connection is encrypted because it uses a modern protocol, you can inspect the actual connection with PowerShell and check its Encrypted property.

The most useful commands are Get-SmbConnection, Get-SmbServerConfiguration, Get-SmbShare, and Get-SmbClientConfiguration.

For a complete SMB security assessment, combine encryption checks with SMB signing, SMB dialect, share permissions, network configuration, and firewall checks. This provides a more complete picture of both SMB security and compatibility on Windows 11.