Smb2Client tool connects to SMB2 servers and lets you list directory contents, transfer files, manage directories and symbolic links, create junctions, watch for changes, and enumerate server-level information including shares, sessions, open files, network interfaces, snapshots, and alternate data streams.
UNC path syntax
All SMB commands that take a<UncPath> use the format:
<port> is an optional integer overriding the default SMB port. The <server> name is used within the SMB2 protocol for negotiation (for example, as the SPN host when using Kerberos). To connect through a SOCKS proxy or to a server at a different IP address, use -HostAddress to specify the actual network address while keeping the original <server> name in the UNC path.
Subcommands
| Command | Description |
|---|---|
| ls | List the contents of a directory |
| get | Download a file or directory tree |
| put | Upload a file to the server |
| rm | Delete a file |
| rmdir | Delete a directory |
| mkdir | Create a directory |
| mklink | Create a symbolic link |
| mount | Create a mount point or junction |
| umount | Unmount a mount point |
| touch | Update timestamps or attributes on a file or directory |
| watch | Watch a directory or subtree for changes |
| enumshares | List shares on the server |
| enumsessions | List active sessions on the server |
| enumopenfiles | List files open on the server |
| enumnics | Query the server for its network interfaces |
| enumsnapshots | List available snapshots for a file or directory |
| enumstreams | List data streams of a file or directory |
For help on any subcommand, run
Smb2Client <subcommand> -h.Common options
Most subcommands share these authentication and connection options:Authentication (credentials)
Authentication (credentials)
User name to authenticate with (not including the domain).
Domain of the authenticating user.
Password to authenticate with.
NTLM hash for pass-the-hash authentication.
Use anonymous login.
Authentication (Kerberos)
Authentication (Kerberos)
KDC endpoint. Required to enable Kerberos.
Path to a TGT file (.kirbi or ccache).
Path to service ticket files (.kirbi or ccache).
Ticket cache file.
AES-128 or AES-256 Kerberos key.
User to impersonate with S4U2self.
Connection
Connection
Override the network address used to connect. Useful when routing through a SOCKS proxy where the server name in the UNC path cannot be resolved directly.
Use TCP over IPv4 only.
Use TCP over IPv6 only.
Require an encrypted SMB connection.
Encrypt PDUs for the target share.
Require signed packets.
SMB2 dialects to negotiate. Possible values:
Smb2_0_2, Smb2_1, Smb3_0, Smb3_0_2, Smb3_1_1.Follow DFS referrals (default: true).
SOCKS5 proxy endpoint.
ls
Lists the contents of a directory. Can also display named pipes (via theIPC$ share) and retrieve detailed file metadata including security descriptors, link targets, and timestamps.
Parameters
Parameters
Directory to list. Accepts wildcard patterns to filter results.
Options
Options
Depth limit for recursive listing.
0 = no recursion (default); -1 = unlimited.Buffer size for the directory listing query.
Snapshot version — date/time or
@GMT token.Fields to display. Available:
RelativePath, Size, SizeOnDisk, FileAttributes, CreationTime, LastAccessTime, LastWriteTime, LastChangeTime, LinkTarget, SecurityDescriptorSddl, Owner, Group, Dacl, Sacl, MaxAccess, ShortName, FileId, FileIndex, EaSize, ReparseTag.Open files with backup semantics.
Examples
get
Downloads a file or directory tree from an SMB share to the local filesystem. The UNC path accepts wildcard patterns (* and ?).
When downloading a single file, specifying <DestinationFileName> is optional — omit it to print the file to the console. When downloading a directory, <DestinationFileName> must be a local directory that either exists or will be created. The default chunk size is 32,768 bytes.
Parameters
Parameters
Options
Options
Directory traversal depth.
0 = current directory only (default); -1 = unlimited.Read chunk size in bytes. Must not exceed the server’s
MaxReadSize. Default: 32768.Copy directory structure without copying files.
Overwrite existing local files.
Continue copying after encountering an error.
Read data directly from storage.
Request the server compress the data.
Snapshot version — date/time or
@GMT token for reading from a shadow copy.Buffer size for directory listing queries during recursive operations.
Examples
put
Uploads a local file to the SMB share.rm
Deletes a file on the SMB share.Parameters
Parameters
Path of the file to delete.
rmdir
Deletes a directory on the SMB share.Parameters
Parameters
Path of the directory to delete.
mkdir
Creates a directory on the SMB share. By default, parent directories are not created. If a parent directory does not exist, the server returnsSTATUS_OBJECT_PATH_NOT_FOUND.
Use -Parents to create the full path. With this flag, Smb2Client mkdir walks the path from the root, creating each level as needed. If the directory already exists with -Parents, no error is generated.
Parameters
Parameters
Path of the directory to create.
Options
Options
Create parent directories as needed.
mklink
Creates a symbolic link on the SMB share. By default the target path is treated as an absolute path and\??\ is prepended automatically. Use -Relative for a relative link. Use -Directory to create a directory symlink.
A symlink contains a substitution path (the actual target) and a print path (what directory listings display). By default both paths are identical. Use -PrintPath to set them independently.
Parameters
Parameters
Examples
mount
Creates a mount point or junction on the SMB share.umount
Unmounts a mount point or junction on the SMB share.Parameters
Parameters
Path of the mount point to remove.
touch
Updates the timestamps and/or file attributes of a file or directory on the SMB share. Use this command to timestomp files or create empty files.Parameters
Parameters
Path of the file or directory to update.
watch
Watches a directory or subtree for modifications and prints a notification each time a change is detected.Parameters
Parameters
Directory to watch.
enumshares
Lists shares on the server using the RPC Server Service interface.Parameters
Parameters
RPC server to interact with.
Options
Options
Level of detail to query. Possible values:
Level1, Level2, Level501, Level502, Level503.Maximum response buffer size.
Fields to display. Available:
ShareName, ServerName, ShareType, Remark, Permissions, MaxUses, CurrentUses, Path, SecurityDescriptorSddl, Flags.enumsessions
Lists active sessions on the server using the RPC Server Service interface. Use-ClientUserName to filter by the user name (without domain). Use -ClientComputer to filter by computer name — Smb2Client enumsessions automatically prepends \\ if you omit it.
Parameters
Parameters
RPC server to interact with.
Options
Options
Level of detail. Possible values:
Level0, Level1, Level2, Level10, Level502.Filter sessions by client computer name.
Filter sessions by user name (without domain).
Maximum response buffer size.
Fields to display. Available:
ClientName, UserName, NumberOfOpens, ConnectedTime, IdleTime, UserFlags, ClientType, Transport.enumopenfiles
Lists files currently open on the server. Use-OpenBy to filter by the user name (without domain). Use -BasePath to filter by path prefix — this must be an absolute path. For regular files it begins with a drive letter (e.g. C:\Windows); for named pipes it begins with \ (e.g. \srvsvc). Wildcards are not supported in -BasePath.
Parameters
Parameters
RPC server to interact with.
Options
Options
Level of detail. Possible values:
Level2, Level3.Filter files open by this user name (without domain).
Filter files whose path starts with this prefix.
Maximum response buffer size.
Fields to display. Available:
Id, Permissions, LockCount, Path, UserName.enumnics
Queries the server for its network interfaces. Clients typically use this to discover additional channels for multi-channel SMB sessions.Parameters
Parameters
UNC path targeting the server.
Options
Options
Fields to display. Available:
InterfaceIndex, Capabilities, LinkSpeed, AddressFamily, EndPoint.enumsnapshots
Lists the available volume shadow copy (VSS) snapshots for a file or directory.Parameters
Parameters
Path of the file or directory to query snapshots for.
Options
Options
Fields to display. Available:
Token, Timestamp.enumstreams
Lists the alternate data streams (ADS) of a file or directory.Parameters
Parameters
Path of the file or directory to query streams for.
Options
Options
Fields to display. Available:
Name, Size, AllocationSize.