{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-156-keep-smb-over-quic-device-admission-separate-from-user-authentication/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-156-keep-smb-over-quic-device-admission-separate-from-user-authentication/", "slug": "dse-20260908-156-keep-smb-over-quic-device-admission-separate-from-user-authentication", "url": "https://update.dsesecurity.com/updates/dse-20260908-156-keep-smb-over-quic-device-admission-separate-from-user-authentication/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-156-keep-smb-over-quic-device-admission-separate-from-user-authentication.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-156-keep-smb-over-quic-device-admission-separate-from-user-authentication/" }, "title": "Keep SMB over QUIC device admission separate from user authentication", "summary": "What does an SMB over QUIC client certificate access list decide?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:14:35+00:00", "modified_at": "2026-09-08T18:26:31+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 1, "word_count": 199, "potentially_affected": "Administrators configuring SMB over QUIC client access control on supported Windows servers.", "dse_recommendation": "Prepare a certificate-to-device inventory and label each required thumbprint with its algorithm.", "primary_source": { "name": "Configure SMB over QUIC client access control in Windows Server", "url": "https://learn.microsoft.com/en-us/windows-server/storage/file-server/configure-smb-over-quic-client-access-control", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

SMB over QUIC client access control permits device allowlists and blocklists without changing the authentication used for the SMB connection. The server validates the client certificate chain and its trust before checking the access list. Administrators can add a certificate hash to that server-maintained list. Microsoft distinguishes the SHA1 thumbprint used by certificate-mapping commands from the SHA256 thumbprint required for client access control. Microsoft documentation.

\n

Applicability

\n

Check the specific server release and feature prerequisites, existing QUIC configuration, client certificate, issuing authority, and administrative permissions. Review device admission and user/share authorization as separate controls.

\n

DSE recommendation

\n

Prepare a certificate-to-device inventory and label each required thumbprint with its algorithm. Have the PKI and file-service owners approve the allowed and blocked test devices. Preserve the existing mappings and access entries before changing admission policy.

\n

Verification

\n

Test an allowed device, a blocked device, and a device with an untrusted certificate chain. For the admitted device, separately verify the intended user’s share permissions. Record the certificate identity and observed rejection stage so a failed device check is not misreported as a user-password problem.

\n

Official references

\n

Microsoft Learn: Configure SMB over QUIC client access control in Windows Server. Source reviewed September 8, 2026.

", "content_text": "Source facts\nSMB over QUIC client access control permits device allowlists and blocklists without changing the authentication used for the SMB connection. The server validates the client certificate chain and its trust before checking the access list. Administrators can add a certificate hash to that server-maintained list. Microsoft distinguishes the SHA1 thumbprint used by certificate-mapping commands from the SHA256 thumbprint required for client access control. Microsoft documentation.\nApplicability\nCheck the specific server release and feature prerequisites, existing QUIC configuration, client certificate, issuing authority, and administrative permissions. Review device admission and user/share authorization as separate controls.\nDSE recommendation\nPrepare a certificate-to-device inventory and label each required thumbprint with its algorithm. Have the PKI and file-service owners approve the allowed and blocked test devices. Preserve the existing mappings and access entries before changing admission policy.\nVerification\nTest an allowed device, a blocked device, and a device with an untrusted certificate chain. For the admitted device, separately verify the intended user’s share permissions. Record the certificate identity and observed rejection stage so a failed device check is not misreported as a user-password problem.\nOfficial references\nMicrosoft Learn: Configure SMB over QUIC client access control in Windows Server. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nSMB over QUIC client access control permits device allowlists and blocklists without changing the authentication used for the SMB connection. The server validates the client certificate chain and its trust before checking the access list. Administrators can add a certificate hash to that server-maintained list. Microsoft distinguishes the SHA1 thumbprint used by certificate-mapping commands from the SHA256 thumbprint required for client access control. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/storage/file-server/configure-smb-over-quic-client-access-control).\n\n## Applicability\n\nCheck the specific server release and feature prerequisites, existing QUIC configuration, client certificate, issuing authority, and administrative permissions. Review device admission and user/share authorization as separate controls.\n\n## DSE recommendation\n\nPrepare a certificate-to-device inventory and label each required thumbprint with its algorithm. Have the PKI and file-service owners approve the allowed and blocked test devices. Preserve the existing mappings and access entries before changing admission policy.\n\n## Verification\n\nTest an allowed device, a blocked device, and a device with an untrusted certificate chain. For the admitted device, separately verify the intended user’s share permissions. Record the certificate identity and observed rejection stage so a failed device check is not misreported as a user-password problem.\n\n## Official references\n\n[Microsoft Learn: Configure SMB over QUIC client access control in Windows Server](https://learn.microsoft.com/en-us/windows-server/storage/file-server/configure-smb-over-quic-client-access-control). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-156-keep-smb-over-quic-device-admission-separate-from-user-authentication/", "url": "https://update.dsesecurity.com/updates/dse-20260908-156-keep-smb-over-quic-device-admission-separate-from-user-authentication/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-156-keep-smb-over-quic-device-admission-separate-from-user-authentication/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Keep SMB over QUIC device admission separate from user authentication", "item": "https://update.dsesecurity.com/updates/dse-20260908-156-keep-smb-over-quic-device-admission-separate-from-user-authentication/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-156-keep-smb-over-quic-device-admission-separate-from-user-authentication/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-156-keep-smb-over-quic-device-admission-separate-from-user-authentication/", "url": "https://update.dsesecurity.com/updates/dse-20260908-156-keep-smb-over-quic-device-admission-separate-from-user-authentication/", "headline": "Keep SMB over QUIC device admission separate from user authentication", "description": "What does an SMB over QUIC client certificate access list decide?", "abstract": "What does an SMB over QUIC client certificate access list decide?", "articleBody": "Source facts\nSMB over QUIC client access control permits device allowlists and blocklists without changing the authentication used for the SMB connection. The server validates the client certificate chain and its trust before checking the access list. Administrators can add a certificate hash to that server-maintained list. Microsoft distinguishes the SHA1 thumbprint used by certificate-mapping commands from the SHA256 thumbprint required for client access control. Microsoft documentation.\nApplicability\nCheck the specific server release and feature prerequisites, existing QUIC configuration, client certificate, issuing authority, and administrative permissions. Review device admission and user/share authorization as separate controls.\nDSE recommendation\nPrepare a certificate-to-device inventory and label each required thumbprint with its algorithm. Have the PKI and file-service owners approve the allowed and blocked test devices. Preserve the existing mappings and access entries before changing admission policy.\nVerification\nTest an allowed device, a blocked device, and a device with an untrusted certificate chain. For the admitted device, separately verify the intended user’s share permissions. Record the certificate identity and observed rejection stage so a failed device check is not misreported as a user-password problem.\nOfficial references\nMicrosoft Learn: Configure SMB over QUIC client access control in Windows Server. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:14:35+00:00", "dateModified": "2026-09-08T18:26:31+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-156-keep-smb-over-quic-device-admission-separate-from-user-authentication/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-156-keep-smb-over-quic-device-admission-separate-from-user-authentication/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep SMB over QUIC device admission separate from user authentication" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 199, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Configure SMB over QUIC client access control in Windows Server", "url": "https://learn.microsoft.com/en-us/windows-server/storage/file-server/configure-smb-over-quic-client-access-control" } } ] } }