13.5 Modern SMB Protocols, SMB Multichannel & SMB over QUIC
Key Takeaways
- SMB 3.1.1 enhances security with Pre-Authentication Integrity (protecting against man-in-the-middle downgrade attacks) and supports AES-128-GCM and AES-256-GCM hardware-accelerated encryption algorithms.
- SMB Multichannel automatically detects and aggregates multiple network paths between client and server, establishing parallel TCP connections per NIC to maximize throughput and deliver transparent failover without manual teaming.
- SMB Direct leverages Remote Direct Memory Access (RDMA) over RoCE, iWARP, or InfiniBand to bypass the operating system network stack, achieving wire-speed throughput, microsecond latency, and near-zero host CPU utilization.
- SMB over QUIC tunnels SMB 3.1.1 over UDP port 443 with TLS 1.3 encryption, requiring Windows Server 2022 Datacenter: Azure Edition or any edition of Windows Server 2025 or later on the server, and providing remote file access across the internet without a VPN.
- Kerberos authentication over SMB over QUIC works without line-of-sight to an on-premises domain controller only when the optional Kerberos KDC Proxy (the KPSSVC service) is configured on the file server; otherwise clients fall back to NTLMv2 inside the TLS 1.3 QUIC tunnel.
Modern SMB Protocols, SMB Multichannel & SMB over QUIC
The Server Message Block (SMB) protocol has evolved from a legacy local area network protocol into a high-performance, cryptographically secure transport capable of powering hyperconverged infrastructures, clustered databases, and zero-trust remote work scenarios. Windows Server integrates SMB 3.1.1, SMB Multichannel, SMB Direct (RDMA), SMB Compression, and SMB over QUIC.
Mastering SMB protocol negotiation, hardware acceleration fabrics, cryptographic signing/encryption policies, and edge remote file access via QUIC is vital for AZ-800 certification.
1. SMB Protocol Evolution & SMB 3.1.1 Security
SMB 3.1.1 introduced critical security enhancements designed to thwart sophisticated network eavesdropping, tampering, and downgrade attacks.
+-----------------------------------------------------------------------------------+
| SMB PROTOCOL EVOLUTION |
| |
| SMB 1.0 (Legacy) ---> Plaintext, chatty, vulnerable (WannaCry / EternalBlue) |
| SMB 2.0 / 2.1 ---> Reduced chattiness, compounding, client caching |
| SMB 3.0 / 3.0.2 ---> SMB Direct (RDMA), SMB Multichannel, AES-128-CCM |
| SMB 3.1.1 (Modern) ---> Pre-Auth Integrity (SHA-512), AES-128/256-GCM, |
| SMB Compression, SMB over QUIC (UDP 443) |
+-----------------------------------------------------------------------------------+
Core Security Features in SMB 3.1.1
- Pre-Authentication Integrity: Utilizes SHA-512 cryptographic hashing to compute a running digest of all negotiation and session establishment messages prior to authentication. This prevents man-in-the-middle attackers from tampering with the protocol negotiation to force downgrade to older, less secure SMB dialects.
- Advanced Encryption Standard (AES) GCM: Supports AES-128-GCM and AES-256-GCM (Galois/Counter Mode) alongside AES-CCM. AES-GCM offers superior performance on processors featuring hardware-accelerated AES-NI instruction sets.
- Secure Dialect Negotiation: Validates that the dialect negotiated between client and server has not been manipulated.
2. SMB Multichannel Architecture
SMB Multichannel enables file servers to use multiple network connections simultaneously. It operates out of the box with zero administrative configuration.
+-----------------------------------------------------------------------------------+
| SMB MULTICHANNEL ARCHITECTURE |
| |
| [SMB Client] [SMB Server] |
| +-------------------+ +-------------------+ |
| | NIC 1 (10 Gbps) | ===(TCP Connection 1 - Session 1)===> | NIC 1 (10 Gbps) | |
| | | ===(TCP Connection 2 - Session 1)===> | | |
| |-------------------| |-------------------| |
| | NIC 2 (10 Gbps) | ===(TCP Connection 3 - Session 1)===> | NIC 2 (10 Gbps) | |
| | | ===(TCP Connection 4 - Session 1)===> | | |
| +-------------------+ +-------------------+ |
| Total Throughput: 20 Gbps (Aggregated Bandwidth + Transparent Failover) |
+-----------------------------------------------------------------------------------+
Key Mechanisms
- Automatic NIC Discovery: When establishing an SMB session, the client queries the server's network interfaces. If multiple adapters or multi-queue/RSS-capable adapters exist on both ends, Multichannel automatically establishes parallel TCP connections.
- Increased Throughput: Aggregates bandwidth across physical interfaces without requiring Switch-Dependent NIC Teaming (LACP) or Switch Embedded Teaming (SET).
- Fault Tolerance: If a physical cable is disconnected or an adapter fails, active I/O instantly shifts to surviving connections without dropping the user session or corrupting open file handles.
- RSS (Receive Side Scaling) Awareness: On systems with high-speed 10/25/100 GbE single-port NICs, Multichannel creates multiple TCP connections across CPU cores, saturating line-rate bandwidth.
# Verify SMB Multichannel connections on the client
Get-SmbMultichannelConnection
# Verify active SMB client network interfaces and RSS/RDMA capabilities
Get-SmbClientNetworkInterface
3. SMB Direct (RDMA)
SMB Direct pairs the SMB 3.x protocol with Remote Direct Memory Access (RDMA) network interface cards, enabling direct memory transfers between client and server RAM without passing through the operating system kernel network stack.
+-----------------------------------------------------------------------------------+
| SMB DIRECT (RDMA) FABRIC |
| |
| [CLIENT RAM] <=======(RDMA Direct Memory Transfer)=======> [SERVER RAM] |
| ^ ^ |
| | (Kernel Bypassed!) (Kernel Bypassed!) |
| v v |
| [Client RDMA NIC] ========(RoCE / iWARP / InfiniBand)========> [Server RDMA NIC]|
| * Near-zero CPU overhead |
| * Microsecond latency |
| * Wire-speed throughput for Hyper-V over SMB & Storage Spaces Direct (S2D) |
+-----------------------------------------------------------------------------------+
Supported RDMA Fabrics
| RDMA Fabric | Transport Layer | Network Requirements & Characteristics |
|---|---|---|
| RoCE (v1 / v2) | UDP / Ethernet | RDMA over Converged Ethernet. RoCE v2 requires a lossless Ethernet fabric configured with Priority Flow Control (PFC - IEEE 802.1Qbb) and Enhanced Transmission Selection (ETS - IEEE 802.1Qaz). |
| iWARP | Standard TCP/IP | Internet Wide Area RDMA Protocol. Operates over standard, lossy commodity Ethernet switches and routers without requiring PFC or Data Center Bridging (DCB). |
| InfiniBand | Native InfiniBand | Proprietary, high-performance computing (HPC) fabric offering ultra-low sub-microsecond latency. |
4. SMB Encryption, Signing & Compression
SMB Encryption vs. SMB Signing
| Security Feature | Primary Purpose | Performance Impact | Configuration Scope |
|---|---|---|---|
| SMB Signing | Guarantees message integrity and authenticity; protects against man-in-the-middle tampering and NTLM relay attacks. Does NOT encrypt payload data. | Minimal CPU overhead (AES-GMAC / AES-CMAC). | Server-wide via Set-SmbServerConfiguration -RequireSecuritySignature $true. Mandatory on Domain Controllers. |
| SMB Encryption | Provides end-to-end payload privacy and integrity (AES-128/256-GCM); prevents packet sniffing across untrusted networks. | Low CPU overhead on hardware with AES-NI. | Configurable per individual share via Set-SmbShare -EncryptData $true or server-wide. |
Set-SmbShare -EncryptData $true makes encryption mandatory for that share, but it does not select a particular cipher. SMB 3.1.1 uses AES-128-GCM by default; to require AES-256-GCM, separately constrain the server's cipher list with Set-SmbServerConfiguration -EncryptionCiphers AES_256_GCM (and ensure clients support it).
SMB Compression
SMB Compression allows administrators and applications to compress files in flight across slow network links without consuming storage space or requiring manual zip extraction.
- Robocopy Integration:
robocopy C:\Data \\Server\Share\Data /compresscompresses files on the fly during data migrations. - Share-Level Compression:
Set-SmbShare -Name 'Software' -CompressData $truemandates compression for all client requests targeting the share.
5. SMB over QUIC Architecture & Deployment
SMB over QUIC provides a secure, zero-trust remote file access solution for telecommuters and mobile workers, replacing traditional legacy Virtual Private Networks (VPNs).
+-----------------------------------------------------------------------------------+
| SMB OVER QUIC ARCHITECTURE |
| |
| [REMOTE MOBILE WORKER] [MICROSOFT AZURE / EDGE] |
| Windows 11 Enterprise Windows Server 2025, any ed.|
| +----------------------+ +-------------------------+ |
| | SMB 3.1.1 Client | | SMB 3.1.1 File Server |
| | | | | |
| | QUIC Layer (TLS 1.3) | ===(UDP Port 443 / QUIC)==>| QUIC Listener (TLS 1.3) |
| | - Server Cert Trust | Zero VPN Required! | - Server Auth Cert |
| | - KDC Proxy Support | | - KDC Proxy (opt-in) |
| +----------------------+ +-------------------------+ |
+-----------------------------------------------------------------------------------+
Architectural Fundamentals
- Transport: Tunnels SMB 3.1.1 protocol traffic over QUIC (RFC 9000) via UDP port 443.
- Encryption: Enforces mandatory TLS 1.3 transport encryption. All authentication headers and file payloads are fully encrypted across the public internet.
- Firewall Traversal: Because traffic traverses UDP port 443 (standard web traffic), it bypasses ISP blocking of TCP port 445.
- OS Requirements:
- Server: Windows Server 2022 Datacenter: Azure Edition (Azure IaaS VM or Azure Local) or any edition of Windows Server 2025 or later. Windows Server 2025 removed the Azure Edition restriction, so Standard and Datacenter both qualify.
- Client: A Windows 11 device. SMB over QUIC is opt-in on the server and clients still prefer TCP; a client only uses QUIC if the TCP attempt fails first or it is forced with
NET USE /TRANSPORT:QUICorNew-SmbMapping -TransportType QUIC.
Kerberos Authentication via KDC Proxy
[!NOTE] The KDC Proxy is optional but recommended, and it is a separately configured component (the
KPSSVCservice plus a URL ACL reservation), not a capability that ships pre-enabled with any particular Windows Server edition. Without it, SMB over QUIC clients authenticate with NTLMv2 inside the TLS 1.3 tunnel.
Traditionally, Kerberos authentication requires direct line-of-sight to an Active Directory Domain Controller (over TCP/UDP ports 88 and 389). SMB over QUIC is designed to pair with a Kerberos KDC Proxy that you enable on the file server. Once it is configured, remote clients send their Kerberos Ticket Granting Service (TGS) requests inside the secure QUIC tunnel; the file server proxies the request to internal Domain Controllers on behalf of the client, enabling pure Kerberos authentication without a VPN.
Deploying SMB over QUIC via PowerShell
# 1. Ensure server certificate with 'Server Authentication' EKU is installed
$Cert = Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Subject -match 'fileserver.contoso.com' }
# 2. Bind the TLS Certificate to the SMB over QUIC listener
New-SmbServerCertificateMapping `
-Name 'fileserver.contoso.com' `
-Thumbprint $Cert.Thumbprint `
-StoreName 'My'
# 3. Enable SMB over QUIC on the file server
Set-SmbServerConfiguration -EnableSMBQUIC $true -Confirm:$false
# 4. Map the share on a remote Windows 11 client over QUIC
New-SmbMapping `
-LocalPath 'Z:' `
-RemotePath '\\fileserver.contoso.com\Sales' `
-Quic $true
A global company needs to grant remote Windows 11 field engineers access to corporate file shares over the public internet. Most remote employees work from hotel Wi-Fi networks where outbound TCP port 445 is blocked by ISPs. The company wants to avoid deploying a traditional client VPN. Which technology solves this requirement?
A systems engineer installs two dual-port 25 GbE network interface cards on a Hyper-V host and a Windows Server 2025 file server. The engineer wants to aggregate throughput across all four ports and ensure automatic failover without configuring NIC Teaming or LACP on the top-of-rack switches. What technology achieves this?
An administrator must enforce payload encryption on a highly confidential 'Payroll' SMB share while allowing other general shares on the same file server to remain accessible without mandatory encryption. Which PowerShell cmdlet applies that requirement at the correct scope?
When remote Windows 11 laptops connect to an SMB over QUIC file server across the internet without a VPN, how do they obtain Kerberos authentication tickets when Domain Controllers are not directly reachable over the internet?