Within your servers, you would generally have file servers.
These file servers would, of course, have file shares.
Now what is common with file shares?
Well, that's the Server Message Block, or the SMB protocol.
As you may know,
the SMB protocol has been vulnerable to various types of
attacks in relation to its different versions.
So with Windows Server 2022, we can enforce enhanced protections for SMB.
Now I'm going to go ahead and show you how we can do
this using the Windows Admin Center.
Within the Windows Admin center, I'm going to navigate to Files & file sharing.
And by the way, I'm working on my member server,
which is Windows Server 2022 Azure Edition.
So in Files & file sharing, from here, when I navigate to File shares,
I will be able to see all of the different file shares
that currently exist on the server.
Now right now, this is a pretty standard file shares,
so I can go ahead and create a new share,
define the location, the permissions.
And as you look down towards the bottom,
you will see that you have the option to Enable SMB encryption.
Now as soon as you enable SMB encryption,
take notice of the notification that pops up.
This means that the client,
which would connect to the server specifically accessing the share,
would need to support SMB Version 3.
Now under modern versions of Windows Server and Windows client,
this should not be a problem because SMB Version 3 is supported.
But if you have really old operating systems,
well, then you may run into some issues.
Now another way that we can hard‑code SMB security onto the
server is by clicking on File server settings.
Within the settings, we are presented with a number of configuration options.
The first check that Windows Admin Center does is to
verify that SMB Version 1 is not installed,
and you'll see by the green check mark that it is not installed.
Now if it was installed,
I would have the option to actually go ahead and Audit SMB 1 connections.
I can also audit it, even though it's not installed,
but I would be able to see if any type of client is
trying to negotiate SMB Version 1.
The next option I have is SMB signing.
This option allows me to require digital signing for my SMB communication,
so I'll go ahead and set this to Required.
And then the last option that I have is to require encryption.
This is where we are forcing the clients to actually use SMB Version 3,
which is a little bit more secure.
Now the options I've got here is to require clients that support it,
or I can require it irrespective if the client supports it or not.
This means that if a client does not support it,
well, then, that connection will be rejected.
So this is a good way that you can go ahead and
configure your SMB settings on your server.
Now one thing that is new with Windows Server 2022 is
the ability to leverage SMB over QUIC.
SMB over QUIC essentially introduces an alternative to the
TCP network transport, providing secure,
reliable connectivity to your Edge file Servers over untrusted networks,
like the internet.
If you had to look at the benefits of QUIC,
you would benefit from things like improved Congestion Control,
packet encryption, and Handshake Authentication using TLS Version 1.3,
and a lot more benefits that you can find on Microsoft's documentation.
Now there are some prerequisites for SMB over QUIC,
and that is the file server must be running Windows
Server 2022 Datacenter Azure Edition.
SMB over QUIC is not supported on any of the other editions.
You also need to make sure that your endpoint client is running Windows 11 and
that you have a public key infrastructure in place because certificate
authentication is used for the SMB over QUIC connections.
Now I do not have any certificate authentication set up,
but I'm going to go ahead and show you how you can configure
SMB over QUIC because it is really simple.
To do that, all you need to do is click on Configure,
and you will then be presented with a certificate selection.
Now, in my case, I've got my default self‑signed certificate,
so I'm going to go ahead and leverage that.
This is the Azure one.
And now I can actually select which addresses I would
like my QUIC clients to connect to.
Now if you add a certificate, of course,
these names could be something that's a little bit more user friendly.
The next option that I have is to enable Kerberos support.
Now, the default is to enable it, which is the recommended way.
I could also go ahead and disable that.
So I'm going to leave this as enabled, and as I expand Advanced Settings,
you'll notice that now I can actually enable SMB encryption,
and I could disable access to named pipes,
which is the recommended option.
From here, I'll go ahead and click on Enabled,
and now Windows Admin Center will configure SMB over QUIC.
And that concludes the setup for SMB QUIC.
As you can see, by making use of the Windows Admin Center,
you can quickly configure various types of security configurations related to SMB at ease.