Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking for ways to encrypt Microsoft SMB data traffic between a client and Windows server or filer appliance. This is not about encrypting the authentication but the actual data transfer.

Is IPSec from the client to a Windows Server my only option?

share|improve this question
Any reason why you don't want to use IPSec - on Windows server it's just a matter of applying a couple of security templates - it's simple and free! – Jon Rhoades Jun 10 '09 at 2:02
Most of our primary storage is on filer appliances and not windows file servers (though both are options for the project that I'm currently working on), and I wanted to be sure that there wasn't a protocol level option. IPSec may be the way I end up going in this case, thanks all! – Bob Jun 10 '09 at 15:16
up vote 4 down vote accepted

CIFS/SMB doesn't have any protocol-level encryption options as of SMBv2, so you're stuck encapsulating the traffic in an encrypted envelope. Which in all practicality means a VPN of some kind. Be it IPSEC, SSL, PPTP.

share|improve this answer

Windows Server 2012 includes a new SMB (3.0) transport encryption option.

share|improve this answer

There's vague references to CIFS/SMB the TLS or SSL on the internet, but nothing obvious and not from Microsoft, so I'd assume it's not all that possible, common, easy or all three.

In that case, if you can't encrypt the protocol, you'll have to do encryption at a lower level, which means a VPN of some form. IPSec is just one way. You could use an encrypted pptp tunnel or something similar.

share|improve this answer

If you're not talking about adding other computers or software to the mix then, yes, IPsec or the built-in VPN functioinality in Windows is the only built-in way to encrypt CIFS/SMB traffic between a Windows Server computer and a client.

You could, obviously, stick hardware-based encryption devices between the client and the server (VPN gateways, routers doing IPsec tunnels, etc). You could install third-party VPN software onto the client and/or server, as well. You can do anything you want to encapsulate, encrypt, or otherwise slice-and-dice the packets once they're on the wire, as long as by the time they make it to the server computer they're decapsulated, decrypted, and glued back together.

share|improve this answer

A simple solution is to create a transparent SSL tunnel with stunnel by installing the client on all end points

share|improve this answer

As for Windows 2012 and SMB 3.0, encryption is now supported. But disabled by default. You can activate it :

To enable encryption for an individual share, run the following on the server:

      Set-SmbShare –Name <sharename> -EncryptData $true

To create a new share with Encryption turned on:

      New-SmbShare –Name <sharename> -Path <pathname> –EncryptData $true

To enable encryption for the entire server, run the following on the server:

      Set-SmbServerConfiguration –EncryptData $true

Beware that clients not supporting SMB3 (prior to Windows 8) won't be able to connect using this version of the protocol.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.