How to Change the SMB Port in Windows Server 2025 and Windows 11
Configure alternative SMB client ports for TCP, QUIC, and RDMA, understand the server-side limitations, and test file-share connectivity without weakening your network security.
SMB Alternative Ports, Explained
Windows 11 24H2 and Windows Server 2025 introduce SMB client support for alternative transport ports. The key is knowing what can be changed on the client and what the SMB server can actually listen on.
1. Understanding SMB Ports in Windows
Server Message Block (SMB) is the protocol Windows uses for network file sharing and related services. Traditional SMB over TCP normally uses TCP port 445. SMB over QUIC uses UDP port 443 by default, while SMB Direct/RDMA deployments use their relevant transport configuration.
With Windows 11, version 24H2 or later, and Windows Server 2025 or later, the SMB client can connect to a server using an alternative TCP, QUIC, or RDMA port. The destination SMB server must already be configured to listen on the requested port.
| Transport | Typical default | Alternative client mapping | Server-side note |
|---|---|---|---|
| SMB over TCP | TCP 445 | -TcpPort | Windows SMB Server TCP listener remains on 445. |
| SMB over QUIC | UDP 443 | -QuicPort | Windows Server can configure an alternative QUIC listening port. |
| SMB Direct / RDMA | Deployment-specific | -RdmaPort | Windows SMB Server does not expose an alternative RDMA listening-port setting. |
2. Prerequisites
- Windows 11 version 24H2 or later, or Windows Server 2025 or later, for the documented alternative-port client feature.
- Administrator permissions on the client when creating SMB mappings.
- A destination SMB server configured to listen on the alternative port and transport.
- Firewall rules and network devices that permit the selected transport and port.
- A test share and a user account with appropriate share and NTFS permissions.
3. Check Windows Versions and SMB Configuration
On both systems, confirm the operating-system version. On the client, also inspect existing SMB mappings and connections before making changes.
Check the operating-system version
Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumberReview existing SMB connections
Get-SmbConnection
Get-SmbMappingConfirm the standard SMB TCP listener on the server
Get-NetTCPConnection -LocalPort 445 -State Listen
Get-SmbServerConfiguration | Select-Object EnableSMB2ProtocolThis confirms whether the normal TCP 445 listener is active. It does not configure an alternative TCP listener.
4. Connect to an Alternative SMB TCP Port from Windows 11
Use this method when the remote SMB server or compatible SMB appliance is already listening on a non-default TCP port. The Windows client mapping specifies the port for that connection; it does not move the built-in Windows SMB Server TCP listener.
Choose a test port and confirm server readiness
In this example, the destination server is assumed to be configured to accept SMB over TCP on port 5445. Do not assume that a Windows Server file server can be made to listen on TCP 5445 using a registry change or an SMB server cmdlet.
Create the SMB mapping with PowerShell
New-SmbMapping -LocalPath "Z:" -RemotePath "\fileserver.contoso.com\Documents" -TcpPort 5445Replace the server name, share name, drive letter, and port with values from your environment.
Verify the mapping and access
Get-SmbMapping
Get-SmbConnection
Get-ChildItem Z:\5. Map an Alternative SMB Port Using NET USE
If you prefer Command Prompt, Windows also documents the /TCPPORT option for a TCP SMB mapping.
NET USE Z: \fileserver.contoso.com\Documents /TCPPORT:5445To remove the mapping after testing:
NET USE Z: /DELETEUse either the PowerShell mapping method or the NET USE method for a given test mapping. Avoid creating duplicate mappings to the same server under conflicting credentials or connection settings.
6. Configure an Alternative SMB over QUIC Server Port
SMB over QUIC provides an encrypted SMB transport over QUIC. Unlike SMB over TCP, Windows Server supports configuring an alternative server listening port for SMB over QUIC. Windows Server 2025 makes SMB over QUIC available in Standard and Datacenter editions as well as the Azure Edition capability available previously.
List configured alternative ports
Get-SmbServerAlternativePortCreate an alternative QUIC port
New-SmbServerAlternativePort -TransportType QUIC -Port 8443 -EnableInstances DefaultChoose a port approved for your environment and confirm it is not already used by another service.
Map the share from a supported SMB client
New-SmbMapping -LocalPath "Q:" -RemotePath "\quic-fileserver.contoso.com\Documents" -QuicPort 8443Use the server name and share path that match your SMB over QUIC deployment and certificate configuration.
Review the configured QUIC port
Get-SmbServerAlternativePortValidate the client connection and review SMB client/server connectivity logs if the mapping fails.
Microsoft also documents Set-SmbServerAlternativePort and Remove-SmbServerAlternativePort for managing alternative SMB server ports. Check the cmdlet help on the target server before changing or removing an existing production configuration:
Get-Help Set-SmbServerAlternativePort -Full
Get-Help Remove-SmbServerAlternativePort -Full7. Connect Using an Alternative RDMA Port
For supported SMB Direct deployments, the SMB client mapping syntax includes the -RdmaPort parameter. This is intended for environments with compatible RDMA-capable network adapters, drivers, and server configuration; it is not a general replacement for TCP port 445.
New-SmbMapping -LocalPath "R:" -RemotePath "\rdma-fileserver.contoso.com\Data" -RdmaPort 5445Use the actual RDMA port configured by the server and validated by your storage/network design. Windows SMB Server does not provide a configurable alternative RDMA listening-port setting in the documented feature.
8. Configure and Validate Firewall Rules
Opening a port on the client does not automatically open it on the server or network firewall. Allow only the required transport, port, source addresses, and destination servers. For SMB over QUIC, configure the selected UDP port end to end.
New-NetFirewallRule -DisplayName "SMB over QUIC UDP 8443" `
-Direction Inbound `
-Protocol UDP `
-LocalPort 8443 `
-Action Allow `
-Profile DomainApply a narrowly scoped rule appropriate to your firewall policy. Do not expose SMB file sharing directly to the public internet. Prefer SMB over QUIC with proper certificate validation for supported remote-access scenarios, or use a VPN/private network with strong access controls.
9. Test SMB Connectivity and Troubleshoot
Run these checks from the client and server to isolate name resolution, routing, firewall, listener, and authentication problems.
Test a TCP endpoint
Test-NetConnection fileserver.contoso.com -Port 5445Tests TCP reachability only; it does not prove SMB authentication or share access.
Review SMB mappings
Get-SmbMapping
Get-SmbConnectionCheck whether the client created the expected mapping and session.
Review server listener
Get-NetTCPConnection -LocalPort 445 -State ListenUse this to verify the normal Windows SMB TCP listener.
Inspect SMB event logs
Get-WinEvent -LogName "Microsoft-Windows-SMBClient/Connectivity" -MaxEvents 30Review relevant client connectivity events and correlate timestamps with the failed attempt.
| Symptom | Possible cause | What to check |
|---|---|---|
| Connection refused or timeout | Server is not listening on the selected port, or a firewall blocks it. | Confirm server-side listener and firewall path. |
| Mapping command fails | Unsupported OS build, invalid parameter, or incorrect share path. | Check Windows version and run Get-Help New-SmbMapping -Full. |
| Authentication failure | Credentials, Kerberos/SPN, or permissions issue. | Validate identity, name resolution, share permissions, and NTFS permissions. |
| QUIC connection fails | QUIC listener, certificate, UDP firewall, or client policy issue. | Check SMB over QUIC configuration, certificate trust, UDP port, and SMB logs. |
| TCP 445 still appears | Expected Windows SMB Server TCP listener behavior. | Remember that alternative TCP client mapping does not reconfigure the Windows server listener. |
10. Security Best Practices
- Do not treat port changes as a security boundary. Moving a client connection to another port does not replace authentication, encryption, patching, or firewall segmentation.
- Restrict SMB access. Permit file-sharing traffic only between trusted clients and servers that require it.
- Use SMB signing and encryption where appropriate. Follow Microsoft security guidance and validate compatibility before enforcing settings.
- Prefer SMB over QUIC for supported remote access. Configure certificates, client access controls, and UDP firewall rules correctly.
- Do not expose TCP 445 to the internet. Use private connectivity or a supported secure remote-access design.
- Document port mappings. Maintain an inventory of server names, transports, ports, firewall rules, and application dependencies.
11. Summary
Windows 11 24H2 and Windows Server 2025 add useful alternative-port capabilities to the SMB client. Administrators can use New-SmbMapping or NET USE to connect over alternative TCP, QUIC, and RDMA ports when the server supports the selected endpoint. The important limitation is server-side: Windows SMB Server can change its alternative listening port for SMB over QUIC, but not for SMB over TCP or RDMA.
Frequently Asked Questions
Can I change the default SMB TCP port 445 on Windows Server 2025?
No. Microsoft documents alternative TCP ports for SMB client connections, but the Windows SMB Server does not support configuring an alternative TCP listening port. Its normal SMB-over-TCP listener remains on TCP 445.
Can Windows 11 connect to an SMB share on a custom TCP port?
Yes, on Windows 11 version 24H2 or later, the SMB client can use New-SmbMapping -TcpPort or the NET USE /TCPPORT option, provided the destination server is listening on that port.
Which Windows versions support alternative SMB client ports?
Microsoft lists Windows 11 version 24H2 or later and Windows Server 2025 or later as prerequisites for this feature.
Can I change the SMB over QUIC listening port?
Yes. Windows SMB Server supports alternative SMB over QUIC listening ports through PowerShell cmdlets such as New-SmbServerAlternativePort and Set-SmbServerAlternativePort.
Does changing the SMB port make file sharing secure?
No. A non-default port is not a substitute for SMB signing, encryption, strong authentication, least-privilege permissions, network segmentation, and firewall restrictions.
Can I use an alternative RDMA port on the Windows SMB server?
The SMB client mapping supports an RDMA port parameter, but Windows SMB Server does not provide the documented alternative RDMA listening-port configuration.
References and Further Reading
- Microsoft Learn: Configure alternative SMB ports
- Microsoft Learn: Secure SMB traffic in Windows Server
- Microsoft Learn: SMB security hardening in Windows Server and Windows Client
- Microsoft Learn: Manage SMB dialects in Windows and Windows Server 2025
- Microsoft Learn: New-SmbMapping PowerShell reference
Keep Your Windows File Services Secure
Explore more practical Windows Server, Active Directory, networking, virtualization, and hybrid-cloud tutorials on VMoreCloud.
Visit VMoreCloud