What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Intune can centrally deploy Windows Defender Firewall rules that allow the inbound traffic needed for SMB file and printer sharing. It does not provide one universal switch that configures every SMB behavior: firewall access, network discovery, printer browsing, SMB dialects, and encryption are separate settings. Configure only the capabilities and network scopes your devices need, and validate them on a pilot group.
What Intune can configure for SMB sharing
Intune’s role in this workflow is to deploy Windows Firewall policy to managed Windows devices. Microsoft’s SMB troubleshooting guidance identifies inbound rules named File and Printer Sharing (SMB-In) and File and Printer Sharing (NB-Session-In) for the issue it describes. Intune does not run the Best Practices Analyzer or automatically turn its findings into a policy; administrators must define the equivalent inbound rules themselves. See Microsoft’s SMB file and printer sharing ports guidance.
As an Amazon Associate I earn from qualifying purchases.
A firewall rule permits or blocks traffic. It does not, by itself, enable all sharing options, make a device discoverable, make shared printers appear in a browse search, set the SMB dialect, or require encryption. Treat each as a separate configuration decision.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesDeploy the inbound firewall rules from Intune
- Choose the policy workflow. Microsoft documents custom rules in a Windows 10 and later Endpoint protection profile under Windows Firewall. The endpoint security Firewall policy also provides a Windows Firewall rules profile for granular port, protocol, application, and network choices. Check the current Intune admin center for the profile names and options applicable to your devices. See Configure Endpoint protection settings in Intune and Intune endpoint security firewall policy.
- Define only required inbound rules. For the Microsoft troubleshooting scenario, review the SMB-In and NB-Session-In rules. The article discusses ports 445 and 139, but the applicable rules depend on OS version and whether legacy NetBIOS-based sharing is actually required. Do not open ports or enable protocols simply because they appear in an older troubleshooting reference.
- Constrain rule scope. Set the network profiles, remote address scope, and device assignments to match the organization’s sharing design. Avoid broad exposure, especially on public networks. These are operational safeguards: pilot and verify the rules in the intended environments before assigning them widely.
- Assign and validate. Assign the policy to a test device group, confirm the expected file or printer sharing path works, and inspect policy status before expanding the assignment. Intune supports up to 150 custom firewall rules in a profile. Microsoft notes that if one rule in the profile fails, the entire profile is reported as failed and none of its rules are applied. Separate profiles can help isolate failures, but increase the number of policies that must be managed.
Which ports does Windows file and printer sharing use?
For the specific issue covered by Microsoft’s troubleshooting page, the named inbound rules correspond to SMB traffic on port 445 and NetBIOS session traffic on port 139. Those references are not a blanket recommendation to enable both ports on every device.
#1 Best Overall
Windows 11 version 24H2 and Windows Server 2025 no longer include SMB NetBIOS ports 137–139 in their built-in firewall rules. SMB2 and later shares do not use those ports; organizations with SMB1 or other legacy requirements should assess those separately. Consult Microsoft’s guidance on securing SMB traffic and verify the Windows version and protocol requirements before creating exceptions.
Why can I connect to a share but not browse for it?
Reaching a known share and discovering devices on a network are different operations. Microsoft describes Network discovery as a setting that helps devices find one another; it can be On, Off, or Custom. Custom can mean discovery is only partly enabled because firewall conditions are unmet. If a device can access a share by its address but does not appear in network browsing, investigate discovery configuration and its firewall conditions rather than assuming the SMB transport rule alone controls browsing. See Microsoft’s small business network setup guidance.
Why is a shared printer missing from the network search?
The Add Printer Wizard’s network search has a separate policy association: the ADMX Printing DownlevelBrowse policy. Its behavior varies with Windows version and printer type, so a working SMB connection does not prove that a shared printer will appear in the wizard’s browse results. Check the applicable OS-specific behavior in Microsoft’s ADMX_Printing Policy CSP documentation, then configure printer discovery separately from the inbound firewall rule.
How SMB dialect and encryption settings affect compatibility
Dialect negotiation
SMB normally negotiates the highest dialect supported by both endpoints, within the documented range from SMB 2.0.2 through SMB 3.1.1. Microsoft documents minimum and maximum dialect controls for Windows 11 version 24H2 and Windows Server 2025 through Group Policy or PowerShell. The cited guidance does not establish a universal equivalent Intune setting across all Windows releases. Review Microsoft’s SMB dialect management guidance before imposing a dialect restriction.
Rank #3
Client encryption requirement
Beginning with Windows 11 version 24H2 and Windows Server 2025, the SMB client can require encryption for outbound SMB connections. A client-side requirement prevents connections to destinations that do not support SMB 3.0 or later and encryption. Microsoft’s procedure documents an OS capability; it does not establish universal Intune configuration support. See Microsoft’s instructions for requiring SMB client encryption.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot by separating the failing layer
- Share is unreachable: Check the inbound firewall policy, destination and network scope, and whether the required SMB protocol is supported at both ends.
- Share works by address but is not listed: Check Network discovery and the firewall conditions for discovery.
- Files work but a printer is absent from network search: Check the Windows version, printer type, and
DownlevelBrowsebehavior. - Only older systems fail: Determine whether they require NetBIOS or SMB1 before considering legacy ports or protocols; do not infer that need from a generic port reference.
- Policy reports failure: For a custom firewall profile, inspect every rule because one failed rule can cause the entire profile’s rules not to apply.
- Newer security settings block a destination: Check dialect compatibility and whether the server supports the required SMB encryption.
For a rollout or failure review, compare the Windows version and profile type, traffic direction, network scope, required destinations and ports, discovery and printer-search needs, dialect and encryption requirements, and the assignment’s blast radius. These distinctions help isolate a policy problem without widening access to compensate for a separate discovery or compatibility issue.
Quick Recap
Rank #4
- Mastering Active Directory: Design, deploy, and protect Active Directory Domain Services for Windows Server 2022, 3rd Edition
- ABIS BOOK
- Packt Publishing
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
