How to Change Windows 11 File Sharing Encryption Level

Option 1Change Encryption Using Windows Settings (🪟 Windows 11 Version 22H2 and newer)

On Windows 11 version 22H2 and newer, file sharing settings live in the Settings ⚙️ app. This is the easiest route because you do not need any advanced tools. Not every build shows the encryption option on this page. If you cannot find File sharing connections at step 5, move on to the Control Panel 🎛️ or Registry Editor methods below.

1. Open Settings. Press Windows key + I on your keyboard. The Settings ⚙️ window opens.
2. Click Network & internet in the left-hand menu. Then, on the right side, click Advanced network settings.
3. Scroll down the Advanced network settings page and click Advanced sharing settings. You now see sharing profiles such as private networks, public networks and all networks.
4. Click the arrow next to All networks to expand it. More options appear underneath.
5. Find the File sharing connections menu and choose your encryption level. You have two choices:

   • 128-bit encryption (recommended): This is the most secure option and is usually the default. Use it if your devices support it.
   • 40- or 56-bit encryption: Choose this if you have trouble connecting with older devices or specific network hardware. It is less secure but works with more devices.

   Click your preferred option in the drop-down menu.
6. Close the Settings window. Your changes are saved automatically.

To undo the change, repeat the steps and select 128-bit encryption (recommended) again. After changing the level, try reconnecting from the device that was failing. If it still cannot connect, the cause is probably something else, such as the sharing protocol version or the credentials.

Option 2Change Encryption Using Control Panel (Older 🪟 Windows 11 Versions)

The Control Panel 🎛️ is the older way to reach the same setting. It is the route for builds where the option is still shown there. Open the Control Panel from the Start menu ⊞ and set the view to large or small icons so the network and sharing items are easy to find.

1. Open Control Panel 🎛️. Click the Start button ⊞, type Control Panel, and click the Control Panel 🎛️ app in the search 🔍 results.

   💡TipSet View by (top right) to Large icons or Small icons to see all options.

   If it is set to Category, click Network and Internet first.

2. Click the Network and Sharing Center icon. The page that opens shows your active networks.
3. On the left side of the Network and Sharing Center, click Change advanced sharing settings. The sharing profiles appear.
4. Click the arrow next to All networks to show more options.
5. Under the File sharing connections section, choose one of these by clicking the circle next to it:

   • 128-bit encryption (recommended)
   • 40- or 56-bit encryption
6. Click the Save changes button at the bottom. Without this, your setting is not applied.

   If you do not see the File sharing connections option, you are likely on a newer Windows 11 version (22H2 or later), where the setting is in the Settings ⚙️ app instead. If it is missing there too, use the Registry Editor method below.

7. Close the Control Panel 🎛️ window.

To undo the change, come back to this page, select 128-bit encryption (recommended) and click Save changes again.

Option 3Manually Change Encryption Using Registry Editor

The Registry Editor lets you set the encryption level by hand when the Settings ⚙️ and Control Panel 🎛️ options are missing or do not stick. It works on Home and Pro. It is also the least forgiving method, because a wrong value in the registry can cause problems that are hard to trace. Take a few minutes to make a backup first.

Before you start: back up the registry. Open Registry Editor, click File › Export, set Export range to All, give the file a name and save it somewhere safe. You can restore it later by double-clicking the .reg file. A restore point is also worth creating if System Protection is turned on for your drive.

While you are in there, write down the existing data of any value you change. That gives you an exact way back if something goes wrong.

To Use 128-bit Encryption (Default and Recommended)

Use these steps to set or confirm 128-bit encryption, which is the Windows 11 default. You will edit two values under the 🗝️HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSetcopy branch of the registry. Use this method if you changed the level earlier and want to restore it, or if a policy or script has altered it.

1. Open Registry Editor. Click the Start button ⊞, type regedit, and click Registry Editor. Click Yes if a User Account Control (UAC) prompt appears. The Registry Editor window opens with a folder tree on the left.
2. Go to the correct registry path. In the left pane, browse to this location:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

   You can also copy and paste this path into the address bar at the top of the Registry Editor and press Enter.

3. Find or create the NtlmMinClientSec value. In the right pane, look for a value called NtlmMinClientSec. If it is there, double-click it. If not, right-click an empty space, select New, and then choose DWORD (32-bit) Value. Name it exactly NtlmMinClientSec. The value should look like this:

   • Value Name: NtlmMinClientSec
   • Value Type: REG_DWORD
   • Value Data: 20000000 (in hexadecimal)

   Double-click the value, enter 20000000 into the Value data box and click OK. Make sure Base is set to Hexadecimal.
4. Find or create the NtlmMinServerSec value. Look for a value called NtlmMinServerSec. If it is not there, create it as a new DWORD (32-bit) Value, the same way as in the previous step. The value should look like this:

   • Value Name: NtlmMinServerSec
   • Value Type: REG_DWORD
   • Value Data: 20000000 (in hexadecimal)

   Double-click it, enter 20000000 into the Value data box and click OK.

   💡TipThe hexadecimal value 20000000 tells Windows to use 128-bit encryption.

   This is the most secure setting.

5. Close Registry Editor.
6. Restart your 🔄 computer. This helps make sure the changes are applied correctly.

To undo these edits, import the backup .reg file you exported earlier, or put each value back to the data you noted before changing it. If you created a value yourself and it did not exist before, you can right-click it and choose Delete.

To Use 40- or 56-bit Encryption (Less Secure, More Compatible)

Use these steps only if an older network device cannot connect at 128-bit and the other methods did not help. They lower the level to 40- or 56-bit. The registry location is the same 🗝️HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSetcopy branch as above. Make the registry backup from the previous section first. This lowers your security level, so only do it for a device you trust.

1. Open Registry Editor. Press Windows key + R, type regedit, and press Enter. Click Yes on the UAC prompt. The Registry Editor window opens.
2. Go to the correct registry path. Navigate to this path:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0

3. Find or create the NtlmMinClientSec value. In the right pane, find the NtlmMinClientSec value, or create it as a DWORD (32-bit) Value if it does not exist. The value should look like this:

   • Value Name: NtlmMinClientSec
   • Value Type: REG_DWORD
   • Value Data: 0 (in hexadecimal)

   Double-click the value, enter 0 in the Value data box and click OK.
4. Find or create the NtlmMinServerSec value. Find the NtlmMinServerSec value, or create it as a DWORD (32-bit) Value if needed. The value should look like this:

   • Value Name: NtlmMinServerSec
   • Value Type: REG_DWORD
   • Value Data: 0 (in hexadecimal)

   Double-click the value, enter 0 in the Value data box and click OK.

   Warning: Setting these values to 0 allows older, weaker encryption methods (40- or 56-bit) to be used. This makes your file sharing connections much less secure.

5. Close Registry Editor.
6. Restart your computer. This is needed for the registry changes to work.

After the restart, test the connection from the older device. To go back to the secure setting, follow the previous section again and set both values to the 128-bit data, or import your backup. Do this as soon as the compatibility problem is solved.

Summary

File sharing encryption protects data sent across your local network, and you can adjust it to suit your devices. Newer Windows 11 builds use the Settings app, older builds use the Control Panel, and the Registry Editor covers the cases where neither option is available. Keep 128-bit encryption unless an older device truly cannot connect. If you do lower it, treat that as a temporary fix and restore 128-bit when you can.