Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

FSx Windows - Access-Based Enumeration (ABE) not working

0

Dear, I am experiencing an issue with configuring Access-Based Enumeration (ABE) on our AWS FSx for Windows File Server in the Canadian region. Despite having a properly functioning FSx environment, I cannot access the necessary management interfaces to enable ABE.

Working environment: AWS (testing workload - not a production one) MS AD: Working fine FSx : Working fine (other than ABE) EC2: Windows Server 2025 Datacenter: Admin access working fine: and can connect to FSx Windows through fsmgmt.msc and can create new shares and set privileges accordingly for the users using Group (from MS AD) Workspaces: working fine

Current Behavior (INCORRECT):

  • Users see all folder names in the share
  • Users get "Access Denied" when trying to access unauthorized folders
  • This creates confusion and potential security concerns

Expected Behavior (CORRECT ABE):

  • Users should ONLY see folders they have permissions to access
  • Unauthorized folders should be completely hidden from view

fsmgmt.msc GUI don't have any option to apply this setting for ABE. No option available in Server Manager to Share folder setting for ABE. As FSx Windows is managed service, don't have any remote access.

Tried multiple options, no luck up to now. Any help would be appreciated.

Topics
End User ComputingComputeStorage
Tags
Amazon EC2Amazon WorkSpacesAmazon FSx
Language
English
asked 5 days ago23 views
2 Answers
0

Windows Server 2025 Datacenter

answered 5 days ago
0

ABE must be enabled per SMB share using PowerShell from a domain-joined Windows instance with administrative permissions on the FSx file system.

Run the following command from your EC2 Windows server: Set-SmbShare -Name <ShareName> -FolderEnumerationMode AccessBased

You can verify using: Get-SmbShare | Select Name, FolderEnumerationMode

No direct access to the FSx host OS is required. Once enabled, users will only see folders they have permissions for, and unauthorized folders will be hidden as expected.

This is the only supported method for enabling ABE on FSx for Windows.

answered 5 days ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content