With the advent of Windows Server 2025, secure remote access has evolved further, highlighting one of its most transformative features: SMB over QUIC. As organizations increasingly adopt hybrid and remote work models, the need for seamless, secure, and high-performance file sharing without complex VPN configurations is paramount. SMB over QUIC effectively addresses this requirement.

A cartoon of a rabbit holding a bottle AI-generated content may be incorrect.

Initially introduced in Windows Server 2022 Azure Edition, SMB over QUIC is now integral to broader deployment scenarios in Server 2025. This post will delve into the concept of SMB over QUIC, its operational mechanics, its security advantages, and how to enable it within your infrastructure.

What is SMB over QUIC?

SMB (Server Message Block) is the fundamental protocol utilized by Windows systems for file and printer sharing. It traditionally operates over TCP port 445. Despite its efficiency, securing communications via TCP has necessitated VPNs or direct connections.

QUIC (Quick UDP Internet Connections), developed by Google and standardized by the IETF, is a modern transport protocol running over UDP with TLS 1.3 encryption by default, providing:

  • Faster connection establishment
  • Enhanced performance over high-latency networks
  • Built-in encryption
  • NAT traversal for improved firewall compatibility

SMB over QUIC merges these benefits with SMB’s file-sharing capabilities, offering a modern, secure, and VPN-free access model for file servers.

A rabbit with a hat and wand AI-generated content may be incorrect.

Why SMB over QUIC Matters

Remote access is increasingly prevalent. While VPNs are effective, they can introduce complexity and potential points of failure. SMB over QUIC presents a simpler, more secure alternative.

Key Benefits:

  • Secure by Default: Incorporates TLS 1.3, negating the need for separate SMB traffic encryption.
  • No Need for a VPN: Users connect securely from any location using a client and a server configured for QUIC.
  • Firewall-Friendly: Operates over UDP port 443, mitigating issues with NAT and restrictive firewalls.
  • Performance Optimized: QUIC’s use of multiplexed streams and reduced handshake times augments performance.
  • Modern Mobility: Ideal for dynamic hybrid and mobile-first environments.

These attributes make SMB over QUIC particularly advantageous for industries with distributed teams, field technicians, and remote offices.

How SMB over QUIC Works

The architecture of SMB over QUIC is straightforward yet highly effective:

  • Transport Layer: Uses QUIC instead of TCP, encapsulating SMB within QUIC over UDP.
  • Encryption: Employs TLS 1.3 for end-to-end encryption by default.
  • Certificates: Requires server authentication through TLS certificates, akin to HTTPS.
  • Client Authentication: Utilizes Azure AD, certificate-based authentication, or Kerberos for client authentication.

Through these layers, SMB over QUIC ensures confidentiality, integrity, and authentication without the VPN-related overhead or complex tunneling configurations.

Requirements for SMB over QUIC in Server 2025

To leverage SMB over QUIC, ensure your environment meets the following criteria:

  • Windows Server 2025 (Datacenter or Standard) with the SMB over QUIC feature installed
  • TLS Certificate for the file server
  • UDP port 443 open on the firewall (inbound to the server)
  • Client devices running Windows 11 or Windows 10 22H2+
  • Optional Azure AD or hybrid identity integration for simplified authentication

Real-World Use Cases

  • Remote Teams: Facilitates access to on-prem file shares without VPN complexities.
  • Mobile Field Workers: Securely connects tablets and laptops to HQ resources.
  • M&A or Partner Access: Enables secure resource access without domain integration.
  • Education and Healthcare: Shares files securely with remote students, educators, or clinicians.

Given its ease of deployment and robust security, SMB over QUIC is suited to both enterprise and SMB applications.

Monitoring and Troubleshooting

Windows Server 2025 provides native event logging for SMB over QUIC, simplifying troubleshooting. Key tools include:

  • Event Viewer: Logs under Microsoft-Windows-SMBServer/QUIC
  • Performance Monitor: SMBServer counters for QUIC sessions
  • Wireshark: For packet analysis (monitor UDP 443 traffic and QUIC handshakes)
  • PowerShell: Utilize Get-SmbServerConfiguration and Get-SmbConnection

Limitations and Considerations

While SMB over QUIC is powerful, consider the following limitations:

  • Not for legacy clients: Older OS versions lack support.
  • Requires TLS certs: Effective certificate management is essential.
  • No printer sharing: Restricted to file shares.
  • Performance tuning: High-throughput environments may require QUIC optimization.

Looking Ahead

As Microsoft continues to enhance SMB over QUIC, anticipate deeper integration with Azure Arc, Intune, and other endpoint security tools. The objective is to provide seamless SMB access regardless of file or user locations.

Future improvements may include GUI-based configuration in Windows Admin Center, advanced group policy settings, and enhanced telemetry for QUIC performance.

Conclusion

SMB over QUIC is one of the standout features of Windows Server 2025. It offers IT professionals a modern means to deliver secure file sharing without traditional VPN complexities. With inherent encryption, improved performance, and a mobile-first design, it is perfectly suited to today’s distributed work environments.

Organizations evaluating Windows Server 2025 or modernizing their infrastructure should prioritize SMB over QUIC as a key feature.

 

Thanks,

 

Emile