WINDOWS SERVER 2025 • FILE SERVICES • NFS

NFS Setup Guide on Windows Server 2025 for File Sharing

Learn how to install Server for NFS, create a network file share, configure client access, and connect Linux or UNIX systems to Windows Server 2025.

Platform: Windows Server 2025

Difficulty: Intermediate

Focus: Cross-platform storage

Author: Khurram Shahzad

Featured image area: This built-in visual illustrates the NFS sharing architecture. For WordPress thumbnails and social previews, upload a separate 16:9 featured image as well.

What you’ll buildA Windows Server 2025 host that publishes a controlled NFS share to compatible Linux or UNIX clients. The examples use a dedicated data folder and a private lab subnet; replace sample paths and addresses with your own environment.

Install Server for NFS

Add the NFS role service using elevated PowerShell or Server Manager.

Create a controlled share

Define the share path, authentication mode, and allowed client hosts.

Connect and validate

Mount the share from Linux, test access, and troubleshoot identity mapping.

1. What Is NFS in Windows Server 2025?

Network File System (NFS) is a network file-sharing protocol commonly used by Linux, UNIX, and other systems to access remote directories. Windows Server includes Server for NFS to publish shares and Client for NFS to access NFS exports from other servers. This is useful in mixed environments where Linux applications, virtualization infrastructure, or UNIX workloads need access to shared data hosted on Windows storage.

NFS is different from SMB. SMB is the usual choice for Windows-native file sharing, while NFS is often preferred for Unix-style workflows. Choose the protocol that matches the client operating systems, identity model, application requirements, and security design.

Component	Purpose	Typical use
Server for NFS	Publishes NFS exports from Windows Server.	Linux clients access a Windows-hosted share.
Client for NFS	Connects Windows to a remote NFS server.	Windows accesses a Linux/UNIX NFS export.
Identity mapping	Maps Windows identities to UNIX UID/GID identities where required.	Controls file ownership and permissions across platforms.

2. Prerequisites and Example Lab

Before starting, sign in to Windows Server 2025 with a local administrator or an account delegated to install roles. Confirm that your server has a stable IP address and that the Linux client can reach it over the network.

Windows NFS server

Windows Server 2025
Static IP: 192.168.1.20 (example)
Data folder: D:\NFS\Projects
Share name: Projects

Linux client

Compatible Linux distribution
Client address: 192.168.1.50 (example)
NFS client utilities installed
Matching identity/authentication configuration

Important identity noteAllowing a client IP at the share level does not automatically solve UNIX UID/GID mapping or authentication. For production NFSv4.1, Microsoft recommends Kerberos security (krb5, krb5i, or krb5p). Use an appropriately configured identity mapping strategy and avoid unauthenticated access.

3. Install the Server for NFS Role

3.1

Open an elevated PowerShell session

3.2

Install the NFS server role service

Run the supported Windows Server feature installation command:

Install-WindowsFeature -Name FS-NFS-Service -IncludeManagementTools

Wait for the command to complete. Review the Success and Restart Needed fields in the result.

3.3

Confirm that the role is installed

Get-WindowsFeature -Name FS-NFS-Service

The feature should show as installed. If you prefer a graphical workflow, use Server Manager → Manage → Add Roles and Features → File and Storage Services → File and iSCSI Services → Server for NFS.

4. Prepare the Folder to Share

Use a dedicated data volume or folder rather than exporting a system directory. This example creates D:\NFS\Projects; make sure drive D: exists, or substitute an appropriate path.

New-Item -Path 'D:\NFS\Projects' -ItemType Directory -Force
Get-Item 'D:\NFS\Projects'

Decide which team or application needs access, what read/write level is required, and how UNIX identities will map to Windows identities. Document the intended client hosts before publishing the share.

Planning tipFor a production deployment, test access using a non-privileged account and representative Linux client first. Do not assume NTFS permissions, NFS share permissions, and UNIX file ownership are interchangeable.

6. Configure Authentication and Client Permissions

NFS authentication must match your environment. Microsoft’s guidance recommends Kerberos for NFSv4.1 and NFSv3 deployments, with stronger options available:

Mode	Protection	Guidance
`krb5`	Kerberos authentication	Authenticates the user/service identity.
`krb5i`	Authentication + integrity	Detects modification of NFS traffic.
`krb5p`	Authentication + integrity + privacy	Encrypts NFS traffic; strongest of these options.
`sys` / AUTH_SYS	Client-supplied UID/GID credentials	Weaker; restrict to carefully isolated test environments if used.

Use Server Manager’s NFS share permissions to restrict access to a specific host, client group, netgroup, or other supported scope. Avoid granting all machines access unless there is a documented reason. If your clients are not configured for Kerberos, pause and design identity mapping/authentication before switching to a weaker method merely to make a test mount work.

Security warningDo not enable unmapped or anonymous access for convenience on a production server. It can remove important authentication protections. Limit network access to trusted subnets and only the required NFS/RPC services.

7. Mount the NFS Share on Linux

The following example shows the client-side workflow on a Debian/Ubuntu-based Linux host. Your distribution may use a different package manager or service configuration. The Linux client must support the selected NFS version and authentication mode.

Step 7.1 — Install NFS client utilities

sudo apt update
sudo apt install nfs-common

Step 7.2 — Create a mount point

sudo mkdir -p /mnt/projects

Step 7.3 — Check exported shares

Where supported by the server and configured protocol, query the server exports:

showmount -e 192.168.1.20

Note: showmount relies on RPC services and may not enumerate NFSv4-only configurations in every environment. A failed query does not by itself prove that NFSv4 is unavailable.

Step 7.4 — Mount the share

For a client configured for the server’s chosen authentication and NFS version, the general mount form is:

sudo mount -t nfs -o vers=4.1 192.168.1.20:/Projects /mnt/projects

The remote export path depends on how the Windows NFS server presents the share and your NFS version/configuration. If :/Projects does not match your server’s exported namespace, use the path shown by your server configuration and current Microsoft guidance. Do not weaken authentication to resolve an incorrect export path.

Step 7.5 — Verify the mounted share

findmnt /mnt/projects
df -h /mnt/projects
ls -la /mnt/projects

If the share should be writable, test by creating a small temporary file only after permissions and ownership are confirmed.

touch /mnt/projects/nfs-write-test.txt
ls -l /mnt/projects/nfs-write-test.txt

8. Verify and Troubleshoot NFS

Useful Windows PowerShell checks

Get-WindowsFeature -Name FS-NFS-Service
Get-NfsShare
Get-NfsShare -Name 'Projects' | Format-List *
Get-Service *NFS*

Symptom	Likely cause	What to check
Client cannot reach server	Routing, firewall, DNS, or wrong IP.	Confirm IP connectivity and required NFS/RPC traffic from the client network.
Mount reports access denied	Share host restriction, authentication, or identity mapping.	Review NFS share permissions, Kerberos setup, UID/GID mapping, and server logs.
Mount succeeds but writes fail	Read-only share or file-system permission mismatch.	Review share permission and underlying Windows/UNIX identity permissions.
Files show unexpected owners	UID/GID and Windows identity mapping differ.	Align identity mapping and test with the expected user.
`showmount` fails	RPC/mount service is unavailable or NFSv4-only namespace behavior.	Check server protocol configuration and test the configured NFSv4 mount path.

For firewall troubleshooting, permit only the services and ports required by the NFS versions and configuration in use. NFSv3 commonly depends on additional RPC services and ports; do not assume that opening TCP 2049 alone is sufficient for every NFS deployment.

9. Security Best Practices

Use Kerberos authentication, preferably krb5i or krb5p where supported and appropriate.
Restrict the share to named client hosts or defined client groups; avoid all-machine access.
Use a dedicated data volume and grant only the access required by the workload.
Plan and test Windows-to-UNIX identity mapping and UID/GID ownership before production use.
Limit NFS/RPC traffic to trusted networks and use host firewalls and network segmentation.
Keep Windows Server and Linux clients patched; monitor logs and review access periodically.
Back up the data and test restoration independently of the NFS share.
Document the export path, authentication mode, client list, ownership mapping, and recovery process.

10. Frequently Asked Questions

Does Windows Server 2025 support NFS?

Yes. Microsoft’s Windows Server NFS deployment documentation lists Windows Server 2025 as supported for the Server for NFS deployment workflow.

Which PowerShell command installs Server for NFS?

Run Install-WindowsFeature -Name FS-NFS-Service -IncludeManagementTools from an elevated PowerShell session.

Can Linux clients access a Windows NFS share?

Yes, provided the NFS protocol version, authentication, share permissions, network connectivity, and identity mapping are configured compatibly.

Should I use Kerberos or AUTH_SYS?

Microsoft recommends Kerberos for NFSv4.1 and NFSv3. AUTH_SYS relies on client-supplied UID/GID values and lacks the same authentication protections; avoid it for production where possible.

Is NFS the same as SMB?

No. Both provide network file access, but NFS is common in Linux/UNIX environments while SMB is widely used for Windows file sharing. Select the protocol that matches your clients and requirements.

Why can I mount a share but not write to it?

Successful mounting does not guarantee write authorization. Check NFS share permissions, underlying file-system permissions, identity mapping, and the credentials used by the client.

Can I expose NFS directly to the internet?

No. Keep NFS on trusted internal networks or access it through a securely designed private network/VPN. Do not publish NFS ports to the public internet.

Conclusion

Windows Server 2025 Server for NFS enables cross-platform file sharing with Linux and UNIX systems. A reliable deployment involves more than installing a role: you must choose the right authentication model, restrict client access, configure identity mapping, and validate both read and write behavior from a real client.

Deployment checklistInstall the role → prepare a dedicated folder → create the NFS share → configure Kerberos and client permissions → mount from Linux → test access and ownership → restrict network exposure → document backups and operations.

Build Your Windows Server Skills with VMoreCloud

Explore practical guides on Windows Server, Active Directory, Azure, VMware, Linux, networking, backup, and disaster recovery.

Windows Server • File Services • Linux • Hybrid Cloud • Virtualization

Sources & Further Reading

Khurram Shahzad

Hybrid Cloud & Virtualization Engineer

Hybrid Cloud & Virtualization Engineer specializing in VMware, Azure, AWS, Windows Server, Microsoft 365, Linux, networking, backup & disaster recovery. I share practical guides, technical projects and insights into modern IT infrastructure through VMoreCloud.

Technical note: Examples are illustrative and must be validated in your environment. NFS namespace paths, authentication, identity mapping, firewall requirements, and supported features vary by configuration. Test in a non-production environment and consult current Microsoft documentation before deployment.