Configure Access-Based Enumeration (ABE) on Windows Server

5.9K

By default, when a user opens some shared network folder, SMB displays a full list of files and folders on it. Of course, it happens only if the user has permission to access the share. Access Based Enumeration (ABE) allows hiding the specific files and folders for a user who do not have access permission on a file server.

Access Based Enumeration is available on the Windows platform since Windows Server 2003 SP1, and helps to prevent users from seeing files and folders using the share and storage management features of Windows Server.

How Access-Based Enumeration Works

Access-Based Enumeration (ABE) dynamically filters the list of files and folders that users see when they browse a shared folder. Instead of displaying all content within the share, Windows operating system checks the user’s permissions and hides items that the user cannot access.

For example, let’s suppose you have the following shared folder structure:

\\FileServer\Departments

├── Finance
├── HR
├── IT
└── Projects

Note that Access-Based Enumeration does not replace NTFS/share permissions. This feature only hides files and folders from view. Keep in mind that users can access a resource only in case the appropriate permissions are assigned.

Requirements

In order to use Access-Based Enumeration, your environment should meet these requirements:

• ABE is available since Windows Server 2003 SP1. The PowerShell cmdlets (Set-SmbShare, Get-SmbShare) require Windows Server 2012 or later;
• File and Storage Services role installed;
• SMB share configured;
• Proper NTFS permissions assigned.

Limitations of Access-Based Enumeration

Here are limitations that you should consider when using ABE:

• ABE works only with SMB shares;
• ABE does not replace NTFS permissions;
• Users can still access resources (in case they know the exact path and have permissions);
• ABE may slightly increase folder enumeration time on large file shares.

Important: ABE Does Not Replace NTFS Permissions

Access-Based Enumeration hides files and folders from view but does not control access.

• ABE hides objects.
• NTFS and share permissions control access.

You should always config NTFS permissions properly when using ABE.

Configure access based enumeration on Windows Server

Note. To enable Access Based Enumeration, File and Storage Services role must be installed on the server.

ABE is enabled for each folder individually. To configure and manage access based enumeration (ABE), open Server Manager console, and select role File and Storage Services.

Then, go to the Shares section and choose a network folder from the list for which to enable the ABE. Right-click on it, and select its Properties.

Then in the properties of the share switch to the Settings tab. Enabling access based enumeration is as simple as the process to put the check box on Enable access-based enumeration option.

Enable access based enumeration using PowerShell

Also, you can enable the access-based enumeration on a network share using PowerShell cmdlet Set-SmbShare. Use a simple command:

Set-SmbShare -Name "Share" -FolderEnumerationMode AccessBased

Creating a New SMB Share with ABE Enabled

When creating a new SMB share, you can enable Access-Based Enumeration during the initial config instead of modifying the share afterward. To do this, use the following PowerShell command:

New-SmbShare `
-Name "Finance" `
-Path "D:\Finance" `
-FolderEnumerationMode AccessBased

The command mentioned above creates a new SMB share and enables Access-Based Enumeration immediately.

In order to check if the share was created with ABE enabled, run the following command:

Get-SmbShare -Name "Finance" |
Select-Object Name, FolderEnumerationMode

Here is an example of its output:

Name FolderEnumerationMode
—- ———————
Finance AccessBased

This approach is particularly useful when provisioning new file shares through PowerShell scripts/automated Windows Server deployments.

Tip. You can enable Access-Based Enumeration when creating new departmental shares (Finance, HR, Legal, and similar folders) to prevent users from browsing folders for which they do not have access permissions.

Check Access-Based Enumeration Status

After enabling Access-Based Enumeration, you can check the current config of an SMB share using PowerShell. To do this, run the following command:

Get-SmbShare -Name "Share" |
Select-Object Name, FolderEnumerationMode

Here is an example of output:

Name FolderEnumerationMode
—- ———————
Share AccessBased

Note that the FolderEnumerationMode property can have one of the following values:

FolderEnumerationMode	Description
AccessBased	Shows only folders the user can access
Unrestricted	Shows all folders

In order to view the Access-Based Enumeration status for all SMB shares on a file server, run the following command:

Get-SmbShare |
Select-Object Name, FolderEnumerationMode

The command mentioned above can be useful when you auditing file server configs or verifying that Access-Based Enumeration has been enabled on the correct shares.

How to Display Detailed Share Config

In order to view the complete Access-Based Enumeration configuration for a specific SMB share, run the following command:

Get-SmbShare -Name "Share" |
Format-List Name, FolderEnumerationMode

You should expect such output:

Name : Share
FolderEnumerationMode : AccessBased

In case the share is not using Access-Based Enumeration, you will see the following value:

FolderEnumerationMode : Unrestricted

The command is useful when troubleshooting SMB share settings/verifying that Access-Based Enumeration was successfully enabled.

Enable Access-Based Enumeration on Multiple SMB Shares

In larger environments, you may need to enable Access-Based Enumeration on multiple SMB shares at once. You can automate this task using PowerShell.

In order to enable ABE on all non-admin SMB shares, run the following command:

Get-SmbShare |
Where-Object {$_.Special -eq $false} |
Set-SmbShare -FolderEnumerationMode AccessBased

In order to disable Access-Based Enumeration, run the following command:

Set-SmbShare -Name "Share" -FolderEnumerationMode Unrestricted

After applying the config, you should check the current ABE status on all shares:

Get-SmbShare |
Select-Object Name, FolderEnumerationMode

Here is an example of output:

Name FolderEnumerationMode
—- ———————
Finance AccessBased
HR AccessBased
Projects AccessBased
Public AccessBased

This approach can be useful when you standardizing file server configs or deploying new Windows file servers.

Important. You should review existing SMB shares before enabling Access-Based Enumeration globally. Some public/collaborative shares may be intentionally configured to allow users to browse folder structures.

Access-Based Enumeration and DFS Namespaces

Note that Access-Based Enumeration can also be used with Distributed File System (DFS) Namespaces. In enterprise environments, you may deploy DFS in order to provide users with a single logical namespace while storing data across multiple file servers.

Here is an example:

\\corp.contoso.com\Shares

├── Finance
├── HR
├── IT
└── Projects

Without Access-Based Enumeration, users may see all DFS folders even if they do not have access permissions to the underlying SMB shares.

Note that DFS Namespace ABE is configured separately from SMB share ABE. In many environments both settings are enabled together.

In case Access-Based Enumeration is enabled, DFS folders that the user cannot access are hidden from view. This makes the namespace easier to navigate and reduces exposure of departmental folder structures.

In order to enable Access-Based Enumeration on a DFS Namespace, follow the steps below:

1. Open DFS Management (dfsmgmt.msc);
2. Expand Namespaces and select the namespace;
3. Open Properties;
4. On the Advanced tab, you need to enable Access-based enumeration;
5. Now apply the changes.

After you enabled ABE, users will only see DFS folders for which they have access permissions.

Note. DFS Access-Based Enumeration relies on the underlying NTFS and SMB permissions. Keep in mind that ABE hides namespace folders but does not replace access control mechanisms.

How does ABE contribute to maintaining data privacy on a network?

ABE plays a critical role in maintaining data privacy by ensuring that users only see the files and folders for which they have access rights. This reduces the chances of unauthorized access to sensitive data and prevents potential information breaches within shared network environments.