How to Check Internal SMB Shares in Windows 11

Learn how to check internal SMB shares in Windows 11 using PowerShell and the Get-SmbShare -IncludeHidden parameter.

Windows 11 can expose several SMB shares that are not always shown in a basic share inventory. Some shares are created or used internally by Windows, applications, or the SMB subsystem, so they may not appear when you perform a simple SMB share query.

If you are troubleshooting Windows file sharing, auditing SMB configuration, or trying to understand why a particular share is not visible in a normal Get-SmbShare result, the -IncludeHidden parameter can provide additional information.

In this guide, you will learn how to use Get-SmbShare -IncludeHidden in Windows 11, understand what the parameter actually does, compare normal and expanded SMB share inventories, inspect individual shares, filter results, export information to CSV, and combine the results with other SMB troubleshooting commands.

What Does IncludeHidden Mean in Get-SmbShare?

The -IncludeHidden parameter is a switch parameter of the Get-SmbShare cmdlet. Microsoft describes it as a way to include SMB shares that are created and used internally when the shares are enumerated.

This distinction is important because the word "hidden" can be misleading.

In Windows networking, a share name ending in a dollar sign, such as C$ or ADMIN$, is commonly called a hidden share. However, the -IncludeHidden parameter of Get-SmbShare is specifically documented as including shares created and used internally.

Therefore, you should not interpret -IncludeHidden as simply meaning "show every share whose name ends with $". It is better understood as an expanded SMB share enumeration option.

Why Check Internal SMB Shares?

Most users only need to know about the normal SMB shares that they created for documents, projects, backups, or other files. However, administrators and troubleshooters may need a more complete view.

Checking internal SMB shares can help when:

• A normal SMB share inventory does not explain an observed network resource.
• You are auditing the SMB configuration of a Windows 11 computer.
• You are troubleshooting applications that use SMB internally.
• You want to compare standard and expanded SMB share enumeration.
• You are investigating unusual SMB behavior.
• You need a more complete configuration report.
• You are documenting a computer before making SMB configuration changes.

The expanded inventory can also be useful when combined with share state, permissions, sessions, connections, and other SMB properties.

Open PowerShell in Windows 11

The easiest way to check SMB shares is through PowerShell.

For a local SMB configuration audit, open PowerShell with administrator privileges:

1. Press Windows + X.
2. Select Terminal (Admin) or PowerShell (Admin).
3. Approve the User Account Control prompt if Windows asks for permission.

You can then run the SMB Share cmdlets described in this guide.

How to List Normal SMB Shares

Before using -IncludeHidden, it is useful to establish a baseline by checking the standard SMB share inventory.

Get-SmbShare

Get-SmbShare retrieves objects representing SMB shares on the computer. Microsoft documents this cmdlet with filtering parameters for properties such as share state, availability type, caching mode, leasing mode, special status, encryption, compression, and other SMB configuration properties.

A normal result may look conceptually similar to:

Name       ScopeName Path             Description
----       --------- ----             -----------
ADMIN$     *         C:\Windows       Remote Admin
C$         *         C:\              Default share
Projects   *         D:\Projects      Project files

The actual output depends on the configuration of your Windows computer.

How to Include Internal SMB Shares

To request an expanded SMB share enumeration, add -IncludeHidden:

Get-SmbShare -IncludeHidden

This instructs Get-SmbShare to include shares that are created and used internally. Microsoft documents -IncludeHidden as a switch parameter for this purpose.

Depending on the system, the additional information may reveal SMB resources that were not obvious from the standard inventory.

Do not assume that every Windows 11 installation will return a large number of additional shares. The result depends on the operating system configuration, installed components, services, applications, and SMB environment.

Compare Normal and Expanded SMB Inventories

A useful troubleshooting technique is to compare the output of the two commands.

First run:

Get-SmbShare

Then run:

Get-SmbShare -IncludeHidden

Compare the results to determine whether the expanded enumeration exposes additional SMB resources.

This is more reliable than guessing based on share names.

Display Only Important Properties

The default output can contain more information than you need. You can use Select-Object to create a cleaner inventory.

Get-SmbShare -IncludeHidden |
Select-Object Name, Path, Description, ScopeName, ShareState

This provides a focused view of several useful properties:

• Name — the SMB share name.
• Path — the local path associated with the share, when applicable.
• Description — the description assigned to the share.
• ScopeName — the scope associated with the SMB share.
• ShareState — the reported state of the share.

This format is useful when creating a quick SMB inventory for troubleshooting or documentation.

How to Display All Properties

If you find an unexpected SMB share, inspect the complete object instead of relying only on the default output.

Get-SmbShare -IncludeHidden |
Format-List *

This can display a much larger set of SMB share properties supported by the system.

You can also inspect one particular share:

Get-SmbShare -Name "Projects" |
Format-List *

The detailed output can help you investigate properties such as share state, availability, caching, leasing, encryption, compression, continuous availability, user limits, and other configuration values.

How to Check a Specific Share

If you already know the share name, the -Name parameter provides a more focused query.

Get-SmbShare -Name "Projects"

For detailed information:

Get-SmbShare -Name "Projects" |
Format-List *

The -IncludeHidden switch is most useful when you want to broaden the enumeration. It does not need to be used simply to inspect a share that you already know by name.

How to Filter the Expanded Results

You can combine -IncludeHidden with PowerShell filtering.

For example, to show the share name, path, and state:

Get-SmbShare -IncludeHidden |
Select-Object Name, Path, ShareState

To show only shares that are currently online:

Get-SmbShare -IncludeHidden |
Where-Object { $_.ShareState -eq "Online" } |
Select-Object Name, Path, ShareState

You can also search for shares whose names contain a particular word:

Get-SmbShare -IncludeHidden |
Where-Object { $_.Name -like "*data*" } |
Select-Object Name, Path, ShareState

This can be useful on computers hosting many SMB shares.

Check Internal Shares and Special Shares Separately

It is important to distinguish -IncludeHidden from the -Special parameter discussed in the previous article.

To list special SMB shares:

Get-SmbShare -Special $true

To request the expanded enumeration:

Get-SmbShare -IncludeHidden

These parameters address different aspects of SMB share enumeration.

For the dedicated special-share guide, see How to Check Special SMB Shares in Windows 11.

The important lesson is that you should not automatically treat every share returned by -IncludeHidden as an administrative share.

Check Internal Shares and Share State

Once you identify an unexpected SMB resource, checking its state can provide additional context.

Get-SmbShare -IncludeHidden |
Select-Object Name, Path, ShareState

Microsoft documents SMB share states including Pending, Online, and Offline.

For a complete explanation of this property, see How to Check SMB Share State in Windows 11.

Check Internal Shares and Share Availability

You can also inspect availability-related properties:

Get-SmbShare -IncludeHidden |
Select-Object Name, Path, AvailabilityType, ContinuouslyAvailable

This can be helpful when investigating advanced SMB configurations, especially in environments involving clustered file servers.

For more information about availability types, see How to Check SMB Share Availability Type in Windows 11.

You can also review Continuous Availability with How to Check SMB Continuous Availability in Windows 11.

Check Internal Shares and Scope Information

Scope information can also be included in the inventory:

Get-SmbShare -IncludeHidden |
Select-Object Name, Path, Scoped, ScopeName

This is especially useful when investigating advanced SMB configurations involving scoped shares and failover cluster file-server resources.

For a detailed explanation of Scoped and ScopeName, see How to Check SMB Share Scope Name in Windows 11.

Check SMB Share Permissions

Finding an internal SMB share does not automatically tell you who can access it.

To inspect the SMB share access control list for a specific share, use:

Get-SmbShareAccess -Name "Projects"

Microsoft documents Get-SmbShareAccess as the cmdlet for retrieving rights granted to security principals for an SMB share.

You can read more about SMB share permissions in How to Check SMB Share Permissions in Windows 11.

Remember that SMB share permissions are separate from NTFS permissions on the underlying folder.

Check Active SMB Sessions

If you are investigating whether an SMB resource is actively being used, check the current SMB sessions.

Get-SmbSession

This can help identify remote clients that currently have SMB sessions with the computer.

See How to Check SMB Sessions in Windows 11 for a complete walkthrough.

Check Active SMB Connections

SMB shares hosted by the computer and SMB connections made by the computer are different concepts.

To inspect SMB client connections:

Get-SmbConnection

Microsoft documents Get-SmbConnection as a cmdlet that retrieves connections established from the SMB client to SMB servers.

For more information, see How to Check SMB Connections in Windows 11.

Check Open SMB Files

If an SMB resource is actively being used, open-file information may help explain what clients are doing.

Get-SmbOpenFile

This is particularly useful when troubleshooting files that appear locked or when investigating active network file access.

See How to Check Open SMB Files in Windows 11 for a detailed guide.

Export Internal SMB Shares to CSV

If you are performing an SMB audit, you may want to save the expanded inventory.

Get-SmbShare -IncludeHidden |
Select-Object Name, Path, Description, Special, Scoped, ScopeName, ShareState, AvailabilityType |
Export-Csv -Path "$env:USERPROFILE\Desktop\internal-smb-shares.csv" -NoTypeInformation

The command creates a CSV file on the current user's desktop.

You can then open the file with a spreadsheet application and use it as a configuration record.

Compare SMB Share Inventories

One useful audit technique is to export both the standard and expanded inventories.

Standard inventory:

Get-SmbShare |
Select-Object Name, Path, Description |
Export-Csv -Path "$env:USERPROFILE\Desktop\smb-shares-standard.csv" -NoTypeInformation

Expanded inventory:

Get-SmbShare -IncludeHidden |
Select-Object Name, Path, Description |
Export-Csv -Path "$env:USERPROFILE\Desktop\smb-shares-expanded.csv" -NoTypeInformation

You can compare the two files to determine whether the expanded enumeration provides additional SMB information on the particular system.

Query Internal SMB Shares on a Remote Computer

In an administrative environment, you may need to inspect another Windows computer.

Get-SmbShare supports CIM sessions, allowing SMB share information to be queried remotely when the environment is configured for remote management.

Create a CIM session:

$session = New-CimSession -ComputerName "PC01"

Then query the expanded SMB share inventory:

Get-SmbShare -CimSession $session -IncludeHidden |
Select-Object Name, Path, Description, Special, Scoped, ScopeName, ShareState

When finished:

Remove-CimSession $session

Remote queries depend on appropriate permissions, authentication, firewall configuration, name resolution, and Windows remote-management settings.

IncludeHidden Is Not the Same as a Dollar-Sign Share

This is one of the most important points in this guide.

Windows commonly uses a dollar sign in names such as:

C$
ADMIN$
D$

These are commonly referred to as hidden or administrative shares because the dollar sign prevents them from being displayed in ordinary network browsing.

However, Get-SmbShare -IncludeHidden is documented specifically as including shares created and used internally.

Therefore, do not build your troubleshooting logic around the assumption that -IncludeHidden simply means "find every share ending in $". Use the actual properties returned by Get-SmbShare.

IncludeHidden vs Special SMB Shares

Feature	PowerShell option	Purpose
Normal enumeration	Get-SmbShare	Retrieve the standard SMB share inventory
Expanded enumeration	Get-SmbShare -IncludeHidden	Include shares created and used internally
Special shares	Get-SmbShare -Special $true	Filter for shares identified as special
Specific share	Get-SmbShare -Name "Projects"	Inspect one known share

Understanding this difference prevents confusion when troubleshooting SMB configurations.

Common Problems When Using IncludeHidden

The Output Looks the Same

It is possible for the normal and expanded commands to produce similar results on a particular Windows installation.

This does not necessarily indicate a problem. The additional internally created or used shares depend on the system environment.

You Expected to See Every Hidden Share

Do not use -IncludeHidden as a simple filter for names ending in $. If you specifically want to inspect share names, use:

Get-SmbShare -IncludeHidden |
Select-Object Name, Path, Special

Then interpret the properties rather than relying only on the name.

An Unexpected Share Appears

If the expanded query reveals an unexpected resource, do not immediately delete or disable it.

First inspect:

• Share name.
• Local path.
• Description.
• Special status.
• Share state.
• Availability type.
• Share permissions.
• Active SMB sessions.
• Open SMB files.
• Server configuration.

This provides much better context before making configuration changes.

Remote Enumeration Does Not Work

If the local command works but a remote CIM query fails, investigate Windows remote-management configuration, authentication, firewall rules, DNS or name resolution, and administrative permissions.

Do not automatically assume that the SMB share itself is the cause of a remote query failure.

Useful PowerShell Commands

Command	Purpose
Get-SmbShare	List SMB shares
Get-SmbShare -IncludeHidden	Include internally created or used shares
Get-SmbShare -Special $true	List special SMB shares
Get-SmbShare -Name "Projects"	Inspect a specific SMB share
Get-SmbShare -Name "Projects" | Format-List *	Display detailed share properties
Get-SmbShareAccess -Name "Projects"	Check SMB share permissions
Get-SmbSession	Check active SMB sessions
Get-SmbConnection	Check SMB client connections
Get-SmbOpenFile	Check open SMB files

Frequently Asked Questions

What does Get-SmbShare -IncludeHidden do?

It expands SMB share enumeration to include shares that are created and used internally, according to Microsoft's documentation.

Does IncludeHidden show C$ and ADMIN$?

It can include internally created or used shares, but you should not interpret the parameter simply as a filter for dollar-sign shares. Use the returned share properties to determine what each resource represents.

Is IncludeHidden the same as Special?

No. -IncludeHidden controls whether internally created and used shares are included in enumeration, while -Special filters for shares identified as special.

Does IncludeHidden change my SMB configuration?

No. Get-SmbShare -IncludeHidden is an enumeration command. It retrieves information and does not modify the SMB share configuration.

Can I use IncludeHidden with other Get-SmbShare filters?

Yes. You can combine the switch with other supported parameters and PowerShell pipeline commands to build a more focused SMB inventory.

Should I disable an internal SMB share that I do not recognize?

No. First identify what created or uses the share and determine whether it is required by Windows, an application, or another SMB component. Removing or disabling an SMB resource without understanding its purpose can cause unexpected problems.

Final Thoughts

The -IncludeHidden parameter provides an important additional view when auditing SMB shares in Windows 11. Instead of relying only on the standard Get-SmbShare output, you can use:

Get-SmbShare -IncludeHidden

This allows Windows administrators and troubleshooters to include shares that are created and used internally in the SMB share inventory.

The most important distinction is that -IncludeHidden should not be interpreted as simply "show shares ending with a dollar sign." Microsoft documents the parameter specifically for including internally created and used shares.

For a complete SMB investigation, combine the expanded share inventory with share state, availability type, scope, permissions, sessions, connections, open files, server configuration, signing, encryption, compression, and other SMB properties.

By building the investigation around PowerShell properties rather than assumptions based on share names, you can create a much more accurate picture of how SMB is configured on a Windows 11 computer.

---

Related Windows 11 SMB guides:

• How to Check Special SMB Shares in Windows 11
• How to Check SMB Share Scope Name in Windows 11
• How to Check SMB Share State in Windows 11
• How to Check SMB Share Availability Type in Windows 11
• How to Check SMB Folder Enumeration Mode in Windows 11
• How to Check SMB Share Caching Mode in Windows 11
• How to Check SMB Share Permissions in Windows 11
• How to Check SMB Sessions in Windows 11
• How to Check SMB Connections in Windows 11
• How to Check Open SMB Files in Windows 11
• How to Check SMB Server Configuration in Windows 11