SMB over QUIC with Windows Server 2025: Plan secure file access
As of October 20, 2026. If you need to give employees access to Windows file shares from outside, you should not open TCP port 445 to the Internet. SMB over QUIC encapsulates SMB into a QUIC connection that uses TLS 1.3. Microsoft lists Windows Server 2025 in all editions and Windows Server 2022 Datacenter: Azure Edition as server options; Windows 11 is required as a client for companies.
Short conclusion
SMB over QUIC is a suitable option if Windows 11 devices need to reach selected file shares over insecure external networks and a compatible file server with a certificate is available. According to Microsoft, the configuration for Windows Server 2025 is provided via PowerShell. The standard uses UDP/443 extensively; Incoming TCP/445 should expressly remain closed. The procedure does not replace authorization planning and device security or general VPN access for other applications.
Which versions and requirements apply?
| Checkpoint | Required | Planning note |
|---|---|---|
| File Server | Windows Server 2025 Standard/Datacenter or Windows Server 2022 Datacenter: Azure Edition | Server 2025 is configured using PowerShell. |
| Client | Windows 11 for companies | Client and server must reach each other by name. |
| Certificate | PKI trusted by clients; DNS name in the certificate | UseFQDN; do not put an IP address in the SAN list. |
| Firewall | Default incoming UDP/443 | Do not openTCP/445 from the Internet to the file server. |
| Identity | Active Directory or local user account on the server | Continue to set sharing and file permissions tightly. |
Microsoft lists SMB over QUIC as a transport for SMB 3.1.1. QUIC is transported over UDP and incorporates the TLS 1.3 handshake. This means that SMB traffic is encrypted in transit. The connection does not become active automatically: administrators must explicitly set it up on the file server. The server certificate must be trusted by clients and must contain the DNS name they use to access the server. Microsoft does not recommend using an IP address as an alternative certificate name.
How does it differ from classic SMB over TCP?
With classic SMB over TCP, port 445 is the usual server port. By default, SMB over QUIC uses UDP/443 and uses a certificate-based QUIC transport with TLS 1.3. Microsoft describes this as an alternative to file access over untrusted networks. This is not a license to make the server public in an uncontrolled manner: registration, sharing permissions, client protection, logging and tested recovery remain the tasks of IT.
Strengths and Limitations
- Strength: External Windows file access can occur over an encrypted SMB transport without exposing TCP/445 to the Internet.
- Strength: Windows Server 2025 makes the server function available in standard and data center; the feature is no longer limited to Server 2022 Datacenter: Azure Edition.
- Limit:On the client side, Windows 11 is intended for enterprise use. Devices, server edition, DNS, certificates and authentication must match.
- Boundary: UDP/443 must work along the entire network path. Certificate expiration and renewal are part of the operation.
- Limit: Protection affects transport to SMB shares. This does not make other applications or administrative access a substitute for VPN.
Introduction in six test steps
- Collects all affected shares, owners, permissions, and devices. Decides which users really need external access.
- Checks the server edition: Windows Server 2025 Standard or Datacenter, alternatively Server 2022 Datacenter: Azure Edition.
- Plant DNS and a certificate with full server name that is trusted by clients. Checks validity, renewal and private key rights.
- By default, opens UDP/443 for the intended server path. Do not release TCP/445 incoming from the Internet.
- Sets up SMB over QUIC on the server. For Windows Server 2025, the PowerShell method should be used; According to Microsoft, the WAC configuration is not supported for this.
- Testing from an external network using a shared test account, checking server and client logs and confirming that only the intended shares are reachable.
For a targeted connection test, Microsoft names New-SmbMapping -LocalPath 'Z:' -RemotePath '\\server.example\share' -TransportType QUIC, among others. You must replace the placeholder with the actual FQDN and release name. Only when name resolution, certificate, registration and authorizations work together should access be released for the intended user group.
Setup video
Which option suits the operation?
For an existing Windows server operation with Windows 11 end devices, SMB over QUIC can be a targeted way to provide file resources for mobile employees. If, in addition to file storage, other internal applications also need to be accessed or clients do not fit, existing, suitably secured VPN access is still part of the architectural decision. You can find the current Windows server overview and the active offer Windows Server 2025 in the shop. Before purchasing, check the appropriate edition and the actual usage requirements.
Frequent Questions
Can I just open UDP/443 in the router?
No. The server must be configured compliantly, have a trusted certificate and use appropriate DNS names. Additionally, authentication, permissions and an external connection test are required.
Is SMB over QUIC a replacement for VPN or backups?
No. It is a transport route for SMB file shares. It does not replace VPN access for other services, authorization concepts, device protection or independent data backups.
Sources and test bench
Technical information was tested on October 20, 2026 using manufacturer documentation and the QUIC standard. No proprietary benchmarks or lab tests have been performed.
- Microsoft Learn: SMB over QUIC - Requirements and Setup
- Microsoft Learn: What's new in Windows Server 2025
- Microsoft Learn: SMB features and supported versions
- IETF RFC 9000: QUIC as UDP-based transport
Author: TechDesk PE Digital.Networks