Skip to content

Commit 7ba3a45

Browse files
Xelu86Xelu86
authored
Merge pull request #3903 from Xelu86/SMBShare25
Clarify SMB parameters RequireClientAuthentication & SkipClientCertificateAccessCheck WS25
2 parents cadca1a + a0d4a2f commit 7ba3a45

File tree

4 files changed

+68
-20
lines changed

4 files changed

+68
-20
lines changed

‎docset/winserver2025-ps/smbshare/Get-SmbServerCertificateMapping.md‎

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,16 @@ Get-SmbServerCertificateMapping [[-Name] <String[]>] [[-Subject] <String[]>]
2828
The `Get-SmbServerCertificateMapping` cmdlet retrieves the certificates associated with the SMB
2929
server for SMB over QUIC. For more information, see [SMB over QUIC](https://aka.ms/smboverquic).
3030

31+
> [!NOTE]
32+
>
33+
> - If the **RequireClientAuthentication** parameter is set to `$true` and
34+
> **SkipClientCertificateAccessCheck** is set to `$false`, the server will perform both client
35+
> certificate validation and access control checks.
36+
>
37+
> - If the **RequireClientAuthentication** parameter is set to `$true` and
38+
> **SkipClientCertificateAccessCheck** is also set to `$true`, the server will perform client
39+
> certificate validation but no access control checks.
40+
3141
## EXAMPLES
3242

3343
### Example 1 - Retrieve the certificate mapped to two SMB over QUIC server names
@@ -177,13 +187,15 @@ Accept wildcard characters: False
177187
### -SkipClientCertificateAccessCheck
178188

179189
Specifies whether the server should skip the check for client certificate access when a client
180-
connects. When this parameter is set to `$true`, the server will not check whether the client has
181-
access to the certificate it presents. This can be useful in scenarios where the server is acting
182-
as a gateway or proxy, and does not need to perform full certificate validation.
190+
connects. This parameter only applies when the server certificate mapping
191+
**RequireClientAuthentication** value is `$true`. When this parameter is set to `$true`, the server
192+
will not perform the access control checks based on the client certificates. This can be useful in
193+
scenarios where the server is acting as a gateway or proxy and client certificate validation is
194+
sufficient.
183195

184196
However, it can also increase the risk of security breaches. When this parameter is set to
185-
`$false`, the server will check whether the client has access to the certificate it presents before
186-
allowing the client to connect.
197+
`$false`, the server will perform the access control checks based on the client certificates in
198+
addition to the client certificate validation before allowing the client to connect.
187199

188200
```yaml
189201
Type: Boolean[]

‎docset/winserver2025-ps/smbshare/New-SmbServerCertificateMapping.md‎

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,16 @@ New-SmbServerCertificateMapping [-Name] <String> [-Thumbprint] <String> [-StoreN
2828
The `New-SmbServerCertificateMapping` cmdlet associates a certificate to the SMB server for SMB
2929
over QUIC. For more information, see [SMB over QUIC](https://aka.ms/smboverquic).
3030

31+
> [!NOTE]
32+
>
33+
> - If the **RequireClientAuthentication** parameter is set to `$true` and
34+
> **SkipClientCertificateAccessCheck** is set to `$false`, the server will perform both client
35+
> certificate validation and access control checks.
36+
>
37+
> - If the **RequireClientAuthentication** parameter is set to `$true` and
38+
> **SkipClientCertificateAccessCheck** is also set to `$true`, the server will perform client
39+
> certificate validation but no access control checks.
40+
3141
## EXAMPLES
3242

3343
### Example 1 - Map a certificate located in the local machine's personal store
@@ -182,13 +192,15 @@ Accept wildcard characters: False
182192
### -SkipClientCertificateAccessCheck
183193

184194
Specifies whether the server should skip the check for client certificate access when a client
185-
connects. When this parameter is set to `$true`, the server will not check whether the client has
186-
access to the certificate it presents. This can be useful in scenarios where the server is acting
187-
as a gateway or proxy, and does not need to perform full certificate validation.
195+
connects. This parameter only applies when the server certificate mapping
196+
**RequireClientAuthentication** value is `$true`. When this parameter is set to `$true`, the server
197+
will not perform the access control checks based on the client certificates. This can be useful in
198+
scenarios where the server is acting as a gateway or proxy and client certificate validation is
199+
sufficient.
188200

189201
However, it can also increase the risk of security breaches. When this parameter is set to
190-
`$false`, the server will check whether the client has access to the certificate it presents before
191-
allowing the client to connect.
202+
`$false`, the server will perform the access control checks based on the client certificates in
203+
addition to the client certificate validation before allowing the client to connect.
192204

193205
```yaml
194206
Type: Boolean

‎docset/winserver2025-ps/smbshare/Remove-SmbServerCertificateMapping.md‎

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,16 @@ The `Remove-SmbServerCertificateMapping` cmdlet removes the certificates associa
4040
server for SMB over QUIC. For more information, review
4141
[SMB over QUIC](/windows-server/storage/file-server/smb-over-quic).
4242

43+
> [!NOTE]
44+
>
45+
> - If the **RequireClientAuthentication** parameter is set to `$true` and
46+
> **SkipClientCertificateAccessCheck** is set to `$false`, the server will perform both client
47+
> certificate validation and access control checks.
48+
>
49+
> - If the **RequireClientAuthentication** parameter is set to `$true` and
50+
> **SkipClientCertificateAccessCheck** is also set to `$true`, the server will perform client
51+
> certificate validation but no access control checks.
52+
4353
## EXAMPLES
4454

4555
### Example 1 - Remove a certificate mapping for SMB server edge endpoint
@@ -242,13 +252,15 @@ Accept wildcard characters: False
242252
### -SkipClientCertificateAccessCheck
243253

244254
Specifies whether the server should skip the check for client certificate access when a client
245-
connects. When this parameter is set to `$true`, the server will not check whether the client has
246-
access to the certificate it presents. This can be useful in scenarios where the server is acting
247-
as a gateway or proxy, and does not need to perform full certificate validation.
255+
connects. This parameter only applies when the server certificate mapping
256+
**RequireClientAuthentication** value is `$true`. When this parameter is set to `$true`, the server
257+
will not perform the access control checks based on the client certificates. This can be useful in
258+
scenarios where the server is acting as a gateway or proxy and client certificate validation is
259+
sufficient.
248260

249261
However, it can also increase the risk of security breaches. When this parameter is set to
250-
`$false`, the server will check whether the client has access to the certificate it presents before
251-
allowing the client to connect.
262+
`$false`, the server will perform the access control checks based on the client certificates in
263+
addition to the client certificate validation before allowing the client to connect.
252264

253265
```yaml
254266
Type: Boolean[]

‎docset/winserver2025-ps/smbshare/Set-SmbServerCertificateMapping.md‎

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,16 @@ Set-SmbServerCertificateMapping -InputObject <CimInstance[]> [-Flags <Flags>] [-
3838
The `Set-SmbServerCertificateMapping` cmdlet modifies a certificate's association to the SMB server
3939
for SMB over QUIC. For more information, see [SMB over QUIC](https://aka.ms/smboverquic).
4040

41+
> [!NOTE]
42+
>
43+
> - If the **RequireClientAuthentication** parameter is set to `$true` and
44+
> **SkipClientCertificateAccessCheck** is set to `$false`, the server will perform both client
45+
> certificate validation and access control checks.
46+
>
47+
> - If the **RequireClientAuthentication** parameter is set to `$true` and
48+
> **SkipClientCertificateAccessCheck** is also set to `$true`, the server will perform client
49+
> certificate validation but no access control checks.
50+
4151
## EXAMPLES
4252

4353
### Example 1: Enable Named Pipes for the SMB over QUIC endpoint
@@ -187,13 +197,15 @@ Accept wildcard characters: False
187197
### -SkipClientCertificateAccessCheck
188198

189199
Specifies whether the server should skip the check for client certificate access when a client
190-
connects. When this parameter is set to `$true`, the server will not check whether the client has
191-
access to the certificate it presents. This can be useful in scenarios where the server is acting
192-
as a gateway or proxy, and does not need to perform full certificate validation.
200+
connects. This parameter only applies when the server certificate mapping
201+
**RequireClientAuthentication** value is `$true`. When this parameter is set to `$true`, the server
202+
will not perform the access control checks based on the client certificates. This can be useful in
203+
scenarios where the server is acting as a gateway or proxy and client certificate validation is
204+
sufficient.
193205

194206
However, it can also increase the risk of security breaches. When this parameter is set to
195-
`$false`, the server will check whether the client has access to the certificate it presents before
196-
allowing the client to connect.
207+
`$false`, the server will perform the access control checks based on the client certificates in
208+
addition to the client certificate validation before allowing the client to connect.
197209

198210
```yaml
199211
Type: Boolean

0 commit comments

Comments
 (0)