Server Message Block (SMB) is the native file-sharing protocol in Windows Server, and it remains the most efficient way to give users, applications, and other servers access to folders on a Windows VPS. A single VPS running Windows Server 2019, 2022, or 2025 can host dozens of shares with per-folder permission granularity, caching, and shadow-copy support — none of which require third-party software or extra licensing.
Before designing your share layout, make sure the host you pick has the disk I/O and network throughput your workload actually needs — compare Windows VPS providers on our comparison table to shortlist candidates with NVMe storage and generous bandwidth.
When SMB Beats FTP and Cloud Drives
SMB is the right tool when the people or services consuming the files are part of your own organization: it integrates with Active Directory or local accounts, supports opportunistic locking (oplocks) for caching, and gives you per-file audit logs. FTP and SFTP remain better for exchanging files with external parties, and cloud drives are convenient for personal sync, but neither offers the access-control granularity of a Windows share.
| Protocol | Best for | Weakness |
|---|---|---|
| SMB | Internal teams, app servers, AD-integrated access | Port 445 should stay behind a firewall or VPN |
| FTP / SFTP | External partners, one-off transfers | No per-folder inheritance model, weaker audit |
| Cloud drives | Personal sync, mobile access | Latency, per-seat cost, sync conflicts |
Create a Share with Server Manager
The graphical path is straightforward. Open Server Manager, go to File and Storage Services > Shares, click New Share, and choose SMB Share – Quick. Select the volume (on a VPS, keep the OS disk and the data volume separate — sharing from D:\Shares rather than C:\ makes backups and restores far simpler), give the share a name, and set the initial permissions. The wizard creates the folder and share in one step and lets you grant or deny access to individual users and groups immediately.
Create a Share with PowerShell
For repeatable provisioning, PowerShell is faster and documents itself. The SmbShare module creates a share and applies access rules in a single pipeline:
New-Item -ItemType Directory -Path "D:\Shares\Projects" -Force
New-SmbShare -Name "Projects" -Path "D:\Shares\Projects" `
-FullAccess "CONTOSO\devs" `
-ChangeAccess "CONTOSO\interns" `
-ReadAccess "CONTOSOuditors"
Get-SmbShare | Select-Object Name, Path
Revoke-SmbShareAccess -Name "Projects" -AccountName "Everyone"Note the final line: new shares grant Everyone read access by default, and removing that catch-all before you start adding real ACLs is the single most important hardening step for any share on a VPS.
NTFS vs Share Permissions: How They Combine
Every folder on a Windows share has two independent permission layers. The share permission applies at the network boundary, and the NTFS ACL applies at the file system. Windows evaluates both and grants the most restrictive result — a user with Full Control at the share level but Read on NTFS ends up with read-only access. The practical consequence: set share permissions loosely (Authenticated Users, Full Control) and do the real access control with NTFS ACLs, where inheritance, deny rules, and auditing behave predictably.
Apply NTFS Access Control with icacls
The icacls command-line tool applies granular NTFS rules with inheritance flags. The (OI)(CI) flags propagate the rule to child objects and folders, and (M) grants modify while (RX) grants read and execute:
icacls "D:\Shares\Projects" /grant "CONTOSO\devs:(OI)(CI)(M)"
icacls "D:\Shares\Projects" /grant "CONTOSOuditors:(OI)(CI)(RX)"
icacls "D:\Shares\Projects" /inheritance:e
icacls "D:\Shares\Projects" /remove "Everyone"Run icacls "D:\Shares\Projects" /T /Q afterward to list the effective ACL tree. When a user reports “access denied,” check both layers: Get-SmbShareAccess for the share rule and icacls for the NTFS rule, then look for a deny entry that overrides the allow.
Access-Based Enumeration and Shadow Copies
Two features make shared folders on a VPS significantly more pleasant to use. Access-Based Enumeration hides folders the user cannot read, so a projects share no longer shows a dozen directory names to an intern with access to two of them:
Set-SmbServerConfiguration -EnableABE $true -ForceShadow Copies (VSS snapshots of the volume) let users restore a previous version of a file themselves, which cuts restore requests dramatically. Enable them with vssadmin add shadowstorage and a scheduled snapshot task, then point users at the Previous Versions tab in Explorer. Keep the snapshot storage on a separate volume so snapshot growth never fills the data disk.
Performance and Security Tuning
SMB Multichannel aggregates bandwidth across multiple network paths automatically when the VPS exposes several virtual NICs — check Get-SmbServerConfiguration | Select EnableMultiChannel and confirm with Get-SmbMultichannelConnection. On the security side, disable the obsolete SMB 1.0 protocol (a frequent target of worm propagation), enable SMB encryption for shares that carry sensitive data, and restrict TCP 445 in Windows Firewall to your office IP range or VPN subnet:
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart
Set-SmbServerConfiguration -EncryptData $true -Force
New-NetFirewallRule -DisplayName "SMB-Internal" -Direction Inbound `
-Protocol TCP -LocalPort 445 -RemoteAddress 10.0.0.0/8 -Action AllowSummary
A well-configured SMB share turns a Windows VPS into a central file service with granular, auditable access control. Create shares with PowerShell, keep the NTFS ACLs as the single source of truth, remove the Everyone default, enable ABE and shadow copies, and lock port 445 down to trusted subnets. When you size the server, remember that file workloads are storage-bound — see the full specs and pricing on the Windows VPS comparison table to find a plan with NVMe disks and enough RAM for the file cache.
Contabo’s Windows VPS plans offer large NVMe volumes at competitive prices — review Contabo Windows VPS options if you need roomy storage for shared folders.
