How to Check SMB Share Permissions in Windows 11

Learn how to check SMB share permissions in Windows 11 using PowerShell, view access rights, and troubleshoot network share access.

When a folder is shared over a Windows 11 network, access is controlled by more than just the folder's normal Windows permissions. The SMB share itself can have an access control list (ACL) that determines which users or groups are allowed to access the share and what level of share access they receive.

If a user can see a network share but cannot open it, create files, modify existing files, or perform another operation, checking the SMB share permissions can help identify the problem.

Windows PowerShell provides the Get-SmbShareAccess cmdlet for viewing the permissions assigned to an SMB share. In this guide, you will learn how to check SMB share permissions in Windows 11, understand the output, filter permissions by share, compare SMB share permissions with NTFS permissions, and troubleshoot common access problems.

What Are SMB Share Permissions?

SMB share permissions control access to a folder when it is accessed through an SMB network share.

For example, a folder on a Windows 11 computer might be shared using a network path such as:

\\FILESERVER\Projects

The SMB share named Projects can have its own access rules. These rules specify which security principals are allowed or denied access and which share-level rights they receive.

SMB share permissions are separate from the NTFS permissions configured on the underlying folder.

This distinction is important because a user's final access through a network share can be affected by both permission layers.

SMB Share Permissions vs NTFS Permissions

One of the most common sources of confusion in Windows file sharing is the difference between share permissions and NTFS permissions.

Permission Type	Controls
SMB Share Permission	Access through the network share.
NTFS Permission	Access to the files and folders on the local file system.

For example, a user might have permission to access an SMB share but still be unable to modify a file because the NTFS permissions on the underlying folder do not allow modification.

When troubleshooting network access, it is therefore useful to check both permission layers.

You can review our existing guide on how to check shared folder permissions in Windows 11 for the broader NTFS and folder-permission side of the problem.

Why Check SMB Share Permissions?

Checking SMB share permissions can help when troubleshooting problems such as:

• A user cannot access a network share.
• A user can open a share but cannot create files.
• A user can read files but cannot modify them.
• A new user needs access to an existing share.
• You need to verify which accounts have access to a share.
• A share appears to have unexpected permissions.
• You need to compare share-level permissions with NTFS permissions.

How to Check SMB Share Permissions in Windows 11

The easiest PowerShell command for checking SMB share permissions is:

Get-SmbShareAccess

Open Windows Terminal or PowerShell with appropriate administrative permissions and run the command.

The command retrieves access-control information associated with SMB shares on the computer.

Step 1: Open PowerShell as Administrator

Start by opening an elevated PowerShell session.

1. Open the Start menu.
2. Search for PowerShell or Windows Terminal.
3. Right-click the application.
4. Select Run as administrator.
5. Approve the User Account Control prompt if requested.

Administrative permissions are recommended when inspecting SMB server configuration and access-control information.

Step 2: List SMB Share Permissions

Run:

Get-SmbShareAccess

The output can include information such as:

• Share name.
• Scope name.
• Account name.
• Access control type.
• Access right.

A simplified example might look like this:

Name       ScopeName    AccountName        AccessControlType  AccessRight
----       ---------    -----------        -----------------  -----------
Projects   *            CONTOSO\User1      Allow              Change
Projects   *            CONTOSO\Admins      Allow              Full

The actual output on your Windows 11 computer can be different depending on the configured shares and accounts.

Understanding the Get-SmbShareAccess Output

Name

The Name property identifies the SMB share.

For example:

Projects

This is the share name that may appear in a network path such as:

\\FILESERVER\Projects

ScopeName

ScopeName identifies the scope associated with the SMB share.

For ordinary SMB shares on a standalone Windows computer, you may see the computer or default scope information depending on the configuration.

AccountName

AccountName identifies the user, group, computer account, or other security principal associated with the access rule.

Examples can include:

CONTOSO\User1
CONTOSO\Administrators
Everyone

The exact names depend on the accounts and groups configured on the computer.

AccessControlType

AccessControlType indicates whether the access control entry allows or denies access.

The two important values are:

• Allow — grants the specified share access.
• Deny — explicitly denies the specified share access.

When troubleshooting permissions, pay particular attention to explicit deny entries because they can affect the resulting access.

AccessRight

AccessRight indicates the share-level access right assigned by the rule.

Common share-level access rights include:

• Read
• Change
• Full

The exact available values depend on the SMB configuration and PowerShell environment.

How to Check Permissions for One SMB Share

If the computer has multiple SMB shares, you can specify the share name with the -Name parameter.

Get-SmbShareAccess -Name "Projects"

Replace Projects with the actual SMB share name.

This is usually more convenient than reviewing permissions for every share on the computer.

How to Check Multiple SMB Shares

You can specify more than one share name when you need to inspect several shares.

Get-SmbShareAccess -Name "Projects","Documents","Public"

This can be useful when auditing a group of network shares.

How to Display SMB Share Permissions as a List

For detailed troubleshooting, you can pipe the result to Format-List:

Get-SmbShareAccess -Name "Projects" | Format-List

This displays the properties in a vertical format that can be easier to inspect when there are several access-control entries.

How to Show Only Selected SMB Permission Properties

You can use Select-Object when you only need a few properties.

Get-SmbShareAccess -Name "Projects" |
Select-Object AccountName, AccessControlType, AccessRight

This produces a simpler view containing the account, whether access is allowed or denied, and the assigned share-level right.

How to Find All Accounts Allowed to Access a Share

To focus on allowed entries, filter the results using Where-Object:

Get-SmbShareAccess -Name "Projects" |
Where-Object { $_.AccessControlType -eq "Allow" } |
Select-Object AccountName, AccessRight

This can make it easier to review the accounts and groups that have explicit allow entries.

How to Find Deny Entries

To look specifically for deny rules, use:

Get-SmbShareAccess -Name "Projects" |
Where-Object { $_.AccessControlType -eq "Deny" } |
Select-Object AccountName, AccessRight

If the command returns an entry, investigate it carefully when troubleshooting an access problem.

Do not remove a deny rule simply because it appears in the output. First determine why it exists and whether changing it is appropriate for the environment.

How to Check Which SMB Shares Exist

Before checking permissions, you may want to list the SMB shares configured on the computer.

Get-SmbShare

This command helps identify the available share names.

You can then inspect a specific share:

Get-SmbShareAccess -Name "Projects"

This creates a simple two-step workflow:

1. Find the share with Get-SmbShare.
2. Inspect its access rules with Get-SmbShareAccess.

For a broader explanation of shared folders, see How to Check Shared Folders in Windows 11.

How to Check SMB Share Permissions and NTFS Permissions

Checking only the SMB share ACL may not explain the complete access result.

Suppose a user has Full share-level access but the underlying NTFS folder only permits reading. The user may still be unable to modify files because the file-system permission restricts that operation.

For this reason, investigate both:

1. SMB share permissions.
2. NTFS permissions on the underlying folder.

The effective access for a network user depends on the combination of these permission layers and the user's group memberships.

Example: Troubleshooting a User Who Cannot Modify Files

Imagine that a user can open:

\\FILESERVER\Projects

but receives an access-denied message when trying to save changes.

Start by checking the SMB share:

Get-SmbShareAccess -Name "Projects"

Look for the user's account or relevant security groups and review the AccessControlType and AccessRight values.

Then inspect the underlying NTFS permissions on the shared folder.

If the SMB share allows the operation but NTFS does not, the problem is likely on the file-system permission side rather than the SMB share ACL.

Conversely, if the SMB share restricts the user, changing NTFS permissions alone may not solve the network-access problem.

Check the User's SMB Connection

If the user is actively connected to the share, you can also investigate the SMB client connection.

Get-SmbSession

This can help identify active SMB sessions on the server.

You can also review client-side SMB connections with:

Get-SmbConnection

For a detailed guide, see How to Check SMB Sessions in Windows 11 and How to Check SMB Connections in Windows 11.

Check Open Files During an SMB Permission Investigation

If a user is currently working with files on the share, checking open SMB files can provide additional context.

Get-SmbOpenFile

This can show files currently opened through SMB and help identify the client computer, user, session, and file path.

For a dedicated guide, see How to Check Open SMB Files in Windows 11.

Combining share permissions, SMB sessions, connections, and open files can provide a more complete view of a network file-access problem.

Common SMB Permission Problems

User Has No Access to the Share

Check whether the user's account or an appropriate group has an allow entry in the SMB share ACL.

Then verify the NTFS permissions on the underlying folder.

User Can Read but Cannot Modify Files

Check both share-level access and NTFS permissions.

The share may allow access while the NTFS permissions restrict modification, or the share-level permission itself may not provide the required access.

User Can Access the Share but Cannot Open a Specific Folder

Investigate permissions on the underlying directory and its parent folders. Share permissions alone may not explain access to a specific location inside the share.

Permissions Look Correct but Access Is Still Denied

Check the user's actual account, group memberships, NTFS permissions, SMB sessions, and whether an explicit deny rule is present.

Also verify that the user is connecting to the expected computer and share.

Check the Network Path

Make sure the user is accessing the correct SMB share path.

For example:

\\FILESERVER\Projects

rather than accidentally connecting to a different server or similarly named share.

Microsoft also recommends checking that computers are on the same network and that Network Discovery and File and Printer Sharing are configured appropriately when troubleshooting Windows network file sharing.

You can review these related guides:

• How to Check Network Profile in Windows 11
• How to Check Network Discovery Settings in Windows 11
• How to Check File and Printer Sharing Settings in Windows 11
• How to Check Windows 11 Firewall Settings

Useful PowerShell Commands for SMB Permissions

Command	Purpose
Get-SmbShare	List SMB shares.
Get-SmbShareAccess	View SMB share ACL entries.
Get-SmbSession	View active SMB sessions.
Get-SmbConnection	View SMB client connections.
Get-SmbOpenFile	View files currently open through SMB.
Get-SmbShareAccess -Name "Projects"	Check permissions for a specific share.

Should You Change SMB Share Permissions?

Changing SMB share permissions should be done carefully, especially on computers used by multiple people.

Before changing an access rule:

• Identify the affected share.
• Determine which users and groups require access.
• Check the existing share ACL.
• Check the NTFS permissions.
• Consider whether an existing group can be used instead of creating a new rule.
• Verify the result from a client computer.

If you need to modify permissions, PowerShell also provides SMB share access-management cmdlets. For example, Microsoft documents Grant-SmbShareAccess for adding an allow access-control entry to an SMB share.

This article focuses on checking permissions rather than changing them, because reviewing the current configuration first is useful when troubleshooting unexpected access.

Frequently Asked Questions

How do I check SMB share permissions in Windows 11?

Open PowerShell with appropriate administrative permissions and run Get-SmbShareAccess. You can specify a share with -Name.

What PowerShell command shows SMB share permissions?

The main command is Get-SmbShareAccess.

How do I check permissions for one SMB share?

Use Get-SmbShareAccess -Name "ShareName" and replace ShareName with the actual SMB share name.

Are SMB share permissions the same as NTFS permissions?

No. SMB share permissions control access through the network share, while NTFS permissions control access to the underlying files and folders.

Why can a user access a share but not modify a file?

The SMB share may allow access while NTFS permissions restrict modification. Check both permission layers when troubleshooting this situation.

How do I find deny rules on an SMB share?

Use Get-SmbShareAccess and filter the results where AccessControlType equals Deny.

Can I check SMB permissions for multiple shares?

Yes. You can specify multiple names with the -Name parameter or inspect all returned SMB share access entries.

Final Thoughts

Checking SMB share permissions is an important part of troubleshooting Windows 11 network file sharing. The Get-SmbShareAccess PowerShell cmdlet provides a convenient way to inspect the access-control entries associated with an SMB share.

However, SMB share permissions are only one part of the permission model. When a user cannot access, modify, or delete a network file, also check NTFS permissions, user and group membership, active SMB sessions, open files, and the network-sharing configuration.

For a complete SMB troubleshooting workflow, combine this guide with our articles on shared folder permissions, SMB sessions, SMB connections, and open SMB files.