{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-024-select-nfs-authentication-before-creating-a-windows-file-share/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-024-select-nfs-authentication-before-creating-a-windows-file-share/", "slug": "dse-20260908-024-select-nfs-authentication-before-creating-a-windows-file-share", "url": "https://update.dsesecurity.com/updates/dse-20260908-024-select-nfs-authentication-before-creating-a-windows-file-share/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-024-select-nfs-authentication-before-creating-a-windows-file-share.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-024-select-nfs-authentication-before-creating-a-windows-file-share/" }, "title": "Select NFS authentication before creating a Windows file share", "summary": "Which authentication decision should precede the first NFS share?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:16:47+00:00", "modified_at": "2026-09-08T18:17:14+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 2, "word_count": 232, "potentially_affected": "Use this review when planning a Windows-hosted NFS share for a defined client population.", "dse_recommendation": "Document the authentication choice as part of the share design and have both Windows and UNIX administrators review it.", "primary_source": { "name": "Deploy Network File System", "url": "https://learn.microsoft.com/en-us/windows-server/storage/nfs/deploy-nfs", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft describes NFS as a way to share files between Windows Server and UNIX systems using the NFS protocol. Windows Server NFS supports authentication choices including Kerberos and AUTH_SYS. Microsoft advises choosing the method according to security requirements and the NFS version before creating a share. For NFS 4.1 and 3.0, Microsoft recommends Kerberos through RPCSEC_GSS. Server for NFS and Client for NFS can be installed together or on different computers. Microsoft documentation.

\n

Applicability

\n

Use this review when planning a Windows-hosted NFS share for a defined client population. Inventory the client operating systems, protocol versions, intended identities, and access requirements before selecting the server components.

\n

DSE recommendation

\n

Document the authentication choice as part of the share design and have both Windows and UNIX administrators review it. Identify representative users and the files they should and should not access. Keep the initial share scope small enough to inspect. Arrange a change window and an approved way to remove the test access if the agreed identity behavior is not achieved.

\n

Verification

\n

Test the intended client types against the approved authentication design. Record the identity presented and the resulting permissions for allowed and disallowed operations. Include a client that should be refused access. Preserve the share configuration and test evidence together, and resolve unexpected identity mappings before adding more data or clients.

\n

Official references

\n

Microsoft Learn: Deploy Network File System. Source reviewed September 8, 2026.

", "content_text": "Source facts\nMicrosoft describes NFS as a way to share files between Windows Server and UNIX systems using the NFS protocol. Windows Server NFS supports authentication choices including Kerberos and AUTH_SYS. Microsoft advises choosing the method according to security requirements and the NFS version before creating a share. For NFS 4.1 and 3.0, Microsoft recommends Kerberos through RPCSEC_GSS. Server for NFS and Client for NFS can be installed together or on different computers. Microsoft documentation.\nApplicability\nUse this review when planning a Windows-hosted NFS share for a defined client population. Inventory the client operating systems, protocol versions, intended identities, and access requirements before selecting the server components.\nDSE recommendation\nDocument the authentication choice as part of the share design and have both Windows and UNIX administrators review it. Identify representative users and the files they should and should not access. Keep the initial share scope small enough to inspect. Arrange a change window and an approved way to remove the test access if the agreed identity behavior is not achieved.\nVerification\nTest the intended client types against the approved authentication design. Record the identity presented and the resulting permissions for allowed and disallowed operations. Include a client that should be refused access. Preserve the share configuration and test evidence together, and resolve unexpected identity mappings before adding more data or clients.\nOfficial references\nMicrosoft Learn: Deploy Network File System. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nMicrosoft describes NFS as a way to share files between Windows Server and UNIX systems using the NFS protocol. Windows Server NFS supports authentication choices including Kerberos and AUTH_SYS. Microsoft advises choosing the method according to security requirements and the NFS version before creating a share. For NFS 4.1 and 3.0, Microsoft recommends Kerberos through RPCSEC_GSS. Server for NFS and Client for NFS can be installed together or on different computers. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/storage/nfs/deploy-nfs).\n\n## Applicability\n\nUse this review when planning a Windows-hosted NFS share for a defined client population. Inventory the client operating systems, protocol versions, intended identities, and access requirements before selecting the server components.\n\n## DSE recommendation\n\nDocument the authentication choice as part of the share design and have both Windows and UNIX administrators review it. Identify representative users and the files they should and should not access. Keep the initial share scope small enough to inspect. Arrange a change window and an approved way to remove the test access if the agreed identity behavior is not achieved.\n\n## Verification\n\nTest the intended client types against the approved authentication design. Record the identity presented and the resulting permissions for allowed and disallowed operations. Include a client that should be refused access. Preserve the share configuration and test evidence together, and resolve unexpected identity mappings before adding more data or clients.\n\n## Official references\n\n[Microsoft Learn: Deploy Network File System](https://learn.microsoft.com/en-us/windows-server/storage/nfs/deploy-nfs). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-024-select-nfs-authentication-before-creating-a-windows-file-share/", "url": "https://update.dsesecurity.com/updates/dse-20260908-024-select-nfs-authentication-before-creating-a-windows-file-share/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-024-select-nfs-authentication-before-creating-a-windows-file-share/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Select NFS authentication before creating a Windows file share", "item": "https://update.dsesecurity.com/updates/dse-20260908-024-select-nfs-authentication-before-creating-a-windows-file-share/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-024-select-nfs-authentication-before-creating-a-windows-file-share/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-024-select-nfs-authentication-before-creating-a-windows-file-share/", "url": "https://update.dsesecurity.com/updates/dse-20260908-024-select-nfs-authentication-before-creating-a-windows-file-share/", "headline": "Select NFS authentication before creating a Windows file share", "description": "Which authentication decision should precede the first NFS share?", "abstract": "Which authentication decision should precede the first NFS share?", "articleBody": "Source facts\nMicrosoft describes NFS as a way to share files between Windows Server and UNIX systems using the NFS protocol. Windows Server NFS supports authentication choices including Kerberos and AUTH_SYS. Microsoft advises choosing the method according to security requirements and the NFS version before creating a share. For NFS 4.1 and 3.0, Microsoft recommends Kerberos through RPCSEC_GSS. Server for NFS and Client for NFS can be installed together or on different computers. Microsoft documentation.\nApplicability\nUse this review when planning a Windows-hosted NFS share for a defined client population. Inventory the client operating systems, protocol versions, intended identities, and access requirements before selecting the server components.\nDSE recommendation\nDocument the authentication choice as part of the share design and have both Windows and UNIX administrators review it. Identify representative users and the files they should and should not access. Keep the initial share scope small enough to inspect. Arrange a change window and an approved way to remove the test access if the agreed identity behavior is not achieved.\nVerification\nTest the intended client types against the approved authentication design. Record the identity presented and the resulting permissions for allowed and disallowed operations. Include a client that should be refused access. Preserve the share configuration and test evidence together, and resolve unexpected identity mappings before adding more data or clients.\nOfficial references\nMicrosoft Learn: Deploy Network File System. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:16:47+00:00", "dateModified": "2026-09-08T18:17:14+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-024-select-nfs-authentication-before-creating-a-windows-file-share/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-024-select-nfs-authentication-before-creating-a-windows-file-share/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Select NFS authentication before creating a Windows file share" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 232, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Deploy Network File System", "url": "https://learn.microsoft.com/en-us/windows-server/storage/nfs/deploy-nfs" } } ] } }