PowerShell Network Share: Create and Manage SMB Shares

Provisioning a new file server the right way means creating every SMB share with the correct permissions from a script, not clicking through the GUI and hoping the configuration is documented somewhere. The PowerShell network share SMB cmdlets in the SmbShare module let you create, configure, audit, and remove file shares with full permission control — repeatable and version-controlled.

Quick Answer / TL;DR

Use New-SmbShare to create a share, Get-SmbShare to list shares, Set-SmbShare to modify, and Remove-SmbShare to delete. Always set both SMB share permissions AND NTFS permissions for complete access control.

List All SMB Shares

Get-SmbShare lists all SMB shares on the local machine, including administrative shares (C$, ADMIN$, IPC$) and custom shares. Use -Name to filter to a specific share and pipe to Get-SmbShareAccess for permission details.

# List all shares on local machine
Get-SmbShare | Select-Object Name, Path, Description | Format-Table -AutoSize

# List non-admin shares only
Get-SmbShare | Where-Object { -not $_.Special } | Format-Table Name, Path -AutoSize

# List shares on remote server
Get-SmbShare -CimSession server01 | Select-Object Name, Path

Name    Path              Description
----    ----              -----------
ADMIN$  C:\Windows        Remote Admin
C$      C:\               Default share
Data    C:\Shares\Data    Company data
HR      C:\Shares\HR      HR Department

Create a New Share

New-SmbShare creates the SMB share and optionally sets the initial share-level permissions. The folder must already exist — create it with New-Item first. -FullAccess, -ChangeAccess, and -ReadAccess set share permissions for specified accounts. The default when no access parameter is given allows Everyone read access — always be explicit.

# Create share folder first
New-Item -Path 'C:\Shares\Projects' -ItemType Directory -Force | Out-Null

# Create the share with explicit permissions
New-SmbShare -Name 'Projects' `
    -Path 'C:\Shares\Projects' `
    -Description 'Project files' `
    -FullAccess 'CONTOSO\IT-Admins' `
    -ChangeAccess 'CONTOSO\ProjectTeam' `
    -ReadAccess 'CONTOSO\Domain Users'

Write-Host "Share created: \\$env:COMPUTERNAME\Projects"

Set Share Permissions

Share permissions control access through the network path. They work in combination with NTFS permissions — the most restrictive permission wins. Use Grant-SmbShareAccess to add permissions and Revoke-SmbShareAccess to remove them.

# Add a user with Change access
Grant-SmbShareAccess -Name 'Projects' -AccountName 'CONTOSO\jsmith' `
    -AccessRight Change -Force

# Revoke access for a user
Revoke-SmbShareAccess -Name 'Projects' -AccountName 'CONTOSO\OldEmployee' -Force

# View current share permissions
Get-SmbShareAccess -Name 'Projects' | Format-Table AccountName, AccessRight -AutoSize

List Who Has Access

Audit share access across all custom shares on a server. This pattern builds a complete access report suitable for security reviews.

# Audit all share permissions
$shareAudit = Get-SmbShare | Where-Object { -not $_.Special } | ForEach-Object {
    $share = $_
    Get-SmbShareAccess -Name $share.Name | ForEach-Object {
        [PSCustomObject]@{
            ShareName   = $share.Name
            Path        = $share.Path
            Account     = $_.AccountName
            AccessRight = $_.AccessRight
        }
    }
}

$shareAudit | Sort-Object ShareName, Account |
    Export-Csv C:\Reports\SharePermissions.csv -NoTypeInformation
Write-Host "Access report exported to C:\Reports\SharePermissions.csv"

Remove a Share

Remove-SmbShare removes the network share but does NOT delete the underlying folder. Administrative shares (C$, ADMIN$) cannot be permanently removed — they are recreated at each reboot.

# Remove a share (does not delete the folder)
Remove-SmbShare -Name 'OldProject' -Force
Write-Host "Share OldProject removed"

# The folder at C:\Shares\OldProject still exists
Test-Path 'C:\Shares\OldProject'  # True

# Remove share and folder
Remove-SmbShare -Name 'Temp' -Force
Remove-Item -Path 'C:\Shares\Temp' -Recurse -Force
Write-Host "Share and folder removed"

Audit Share Access Events

Windows can audit file share access through the Security event log when object access auditing is enabled. Use Get-WinEvent to query share access events. Event ID 5140 records network share access and 5145 records shared object access.

# Query share access events (requires audit policy enabled)
Get-WinEvent -FilterHashtable @{
    LogName   = 'Security'
    Id        = 5140
    StartTime = (Get-Date).AddHours(-24)
} -ErrorAction SilentlyContinue |
    ForEach-Object {
        $xml = [xml]$_.ToXml()
        [PSCustomObject]@{
            Time      = $_.TimeCreated
            User      = ($xml.Event.EventData.Data | Where-Object Name -eq 'SubjectUserName').'#text'
            Share     = ($xml.Event.EventData.Data | Where-Object Name -eq 'ShareName').'#text'
            IPAddress = ($xml.Event.EventData.Data | Where-Object Name -eq 'IpAddress').'#text'
        }
    } | Format-Table -AutoSize

Common Errors and Fixes

• Share permissions and NTFS permissions are separate — set both. Creating a share with -FullAccess 'Everyone' means nothing if the NTFS permissions on the folder only grant read access. The effective access is the intersection of share and NTFS permissions. Always configure both layers. Use Set-Acl or the Security tab in Windows Explorer to configure NTFS permissions.
• Admin shares (C$, ADMIN$) cannot be deleted permanently. You can remove them temporarily with Remove-SmbShare -Name 'C$' -Force, but they reappear after a service restart or reboot. To permanently disable admin shares, set AutoShareServer and AutoShareWks DWORD values to 0 in HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters.

Related Cmdlets / See Also

• PowerShell Ntfs Permissions
• PowerShell Firewall Rules

Wrapping Up

The SmbShare module provides complete share lifecycle management: create with New-SmbShare, configure with Grant-SmbShareAccess, audit with Get-SmbShareAccess, and remove with Remove-SmbShare. Always set both SMB and NTFS permissions — share permissions alone are not sufficient for security. Script your entire share structure for consistent, reproducible server builds.