How to Create a File Share on Windows Server

That is the whole job in one sentence, but a file share done properly means understanding two separate permission layers and how they combine. This guide covers the role, both ways to create a share, the Share-versus-NTFS distinction that trips everyone up, access-based enumeration, and mapping the share from a Windows 11 client. It is written for Windows Server 2025 and applies essentially unchanged to Server 2016, 2019 and 2022.

Step 1 — Add the File Server role

The SMB server component ships with Windows, so a single quick share does not strictly need a role installed. But to get the managed Shares page and the wizard in Server Manager, add the File Server role service, which lives under the File and Storage Services role.

1. Open Server Manager, click Manage in the top-right corner, and choose Add Roles and Features.
2. Click Next through Before You Begin, keep Role-based or feature-based installation, and select your server.
3. On Server Roles, expand File and Storage Services → File and iSCSI Services, and tick File Server. Click Next, then Install.

Prefer PowerShell? One line does it, and File Server rarely needs a reboot:

Install-WindowsFeature -Name FS-FileServer -IncludeManagementTools

If you want quotas, file screening or reporting later, also add File Server Resource Manager (FS-Resource-Manager). For a deeper walk-through of the wizard itself, see our guide to adding roles and features in Windows Server.

Step 2 — Create the share with the New Share Wizard

This is the recommended path because it creates the folder, shares it, and sets NTFS permissions in one continuous flow.

1. In Server Manager, click File and Storage Services in the left pane, then click Shares.
2. Open the Tasks drop-down (top-right of the Shares tile) and choose New Share. The New Share Wizard opens.
3. On Select the profile for this share, choose a file share profile:
   • SMB Share – Quick — the fastest way to provision a basic share.
   • SMB Share – Advanced — adds control over the folder owner, access-based enumeration, and quotas. (This profile requires the File Server Resource Manager role service.)
   Pick one and click Next.
4. On Select the server and path for this share, keep Select by volume, choose the volume where the share should live (for example D:), and click Next. Windows creates the folder under a Shares directory on that volume, or you can type a custom path.
5. On Specify share name, type the Share name (for example Shared). The local path and the remote UNC path are filled in for you — for example \\FS01\Shared. Click Next.
6. On Configure share settings, tick the options you want:
   • Enable access-based enumeration — hide items a user cannot read (covered below).
   • Allow caching of share — let clients keep offline copies.
   • Encrypt data access — force SMB encryption for this share, so data is protected in transit. Microsoft's SMB security enhancements documentation confirms SMB Encryption can be configured on a per-share basis and protects data from eavesdropping on untrusted networks.
   Click Next.
7. On Specify permissions to control access, review the defaults and click Customize permissions to adjust Share and NTFS permissions (see Step 3). Click Next.
8. On Confirm selections, review everything and click Create, then Close. The share appears on the Shares page.

The classic alternative — right-click, or the Shared Folders snap-in

You can also share any folder without the wizard. Right-click the folder, choose Properties → Sharing → Advanced Sharing, tick Share this folder, set a share name, and click Permissions for the Share ACL. For managing every share on the box in one place, run fsmgmt.msc to open the Shared Folders console, where Shares, Sessions and Open Files let you create shares and see who is connected. These older tools are perfectly valid; the New Share Wizard simply bundles the same steps together.

Step 3 — Share permissions vs. NTFS permissions

This is the part that causes the most confusion, so it is worth slowing down. A network share is guarded by two independent sets of permissions, and both apply at once.

• Share permissions apply only to access that comes in over the network through the SMB share, and they treat the whole share as a single unit. The choices are Read, Change and Full Control.
• NTFS permissions (the Security tab) apply to every file and folder whether reached over the network or locally at the console, and can be set granularly on individual subfolders and files.

When a user connects over the network, Windows evaluates both and grants the most restrictive result. If Share permission is Read but NTFS is Full Control, the user gets Read. If Share is Full Control but NTFS is Read, the user still gets Read. The tighter of the two always wins.

A sensible starting point for a department share:

1. Share permissions: remove any stale entries, add Authenticated Users with Full Control.
2. NTFS permissions: remove broad Write access, then grant the specific group that should use the folder (for example Sales) Modify, and grant read-only groups Read & execute. Keep Administrators and SYSTEM with Full Control.
3. Use security groups, not individual users — it scales and keeps the ACL readable.

In the New Share Wizard, Customize permissions opens a dialog with a Permissions tab (NTFS) and a Share tab, so you can set both without leaving the wizard.

Step 4 — Turn on access-based enumeration

Access-based enumeration (ABE) hides the files and folders a user has no Read permission to, so when they browse the share they see only what they can actually open. It does not grant or deny access by itself — NTFS still does that — it simply filters the listing so people are not teased by folders they cannot enter. It is a per-share setting.

You can enable it while creating the share (the checkbox in Configure share settings), or afterwards: on the Shares page, right-click the share, choose Properties → Settings, and tick Enable access-based enumeration. From PowerShell:

Set-SmbShare -Name Shared -FolderEnumerationMode AccessBased

Set it back to Unrestricted to show all items again — the Set-SmbShare cmdlet reference on Microsoft Learn defines both modes and notes that access-based enumeration is disabled by default on new SMB shares. ABE is especially useful on a large multi-department share where each team should see only its own top-level folder.

Step 5 — Map the share from a client PC

On a Windows 11 client, the quickest test is to browse straight to the UNC path:

1. Open File Explorer, click the address bar, type the path as \\server\share — for example \\FS01\Shared — and press Enter. If prompted, enter domain credentials that have access.

To make it a permanent lettered drive:

1. In File Explorer, right-click This PC and choose Map network drive (or open the ... toolbar menu and select it).
2. Pick a Drive letter, type the UNC path in Folder (for example \\FS01\Shared), and tick Reconnect at sign-in so it persists.
3. Tick Connect using different credentials if you need to authenticate as another account, then click Finish.

Or do it in one command from a terminal:

net use Z: \\FS01\Shared /persistent:yes

In a managed environment, most admins map drives centrally with Group Policy Preferences (User Configuration → Preferences → Windows Settings → Drive Maps) so every user gets the right drives automatically, rather than mapping by hand on each PC.

Quick reference — the whole thing in PowerShell

Everything above can be scripted. This creates a folder, shares it with ABE on, and sets a broad Share ACL so NTFS does the gatekeeping — the -FullAccess and -FolderEnumerationMode parameters used below are both defined in the New-SmbShare cmdlet reference:

New-Item -Path 'D:\Shares\Shared' -ItemType Directory
New-SmbShare -Name 'Shared' -Path 'D:\Shares\Shared' `
  -FullAccess 'Authenticated Users' `
  -FolderEnumerationMode AccessBased
# Then set NTFS permissions on D:\Shares\Shared with icacls or the Security tab.

Inspect what you have at any time with Get-SmbShare and Get-SmbShareAccess -Name Shared.