diff --git a/manila/share/drivers/windows/windows_smb_driver.py b/manila/share/drivers/windows/windows_smb_driver.py
index c3b08404..6b1309fb 100644
--- a/manila/share/drivers/windows/windows_smb_driver.py
+++ b/manila/share/drivers/windows/windows_smb_driver.py
@@ -18,6 +18,8 @@ import os
 from oslo_log import log
 from oslo_utils import units
 
+from manila.common import constants as const
+from manila import exception
 from manila.i18n import _LW
 from manila.share import driver as base_driver
 from manila.share.drivers import generic
@@ -162,3 +164,22 @@ class WindowsSMBDriver(generic.GenericShareDriver):
         disk_number = self._windows_utils.get_disk_number_by_mount_path(
             server_details, mount_path)
         return disk_number is not None
+
+    @generic.ensure_server
+    def allow_access(self, context, share, access, share_server=None):
+        """Allow access to the share."""
+
+        # NOTE(vponomaryov): use direct verification for case some additional
+        # level is added.
+        access_level = access['access_level']
+        if access_level not in (const.ACCESS_LEVEL_RW, const.ACCESS_LEVEL_RO):
+            raise exception.InvalidShareAccessLevel(level=access_level)
+        self._get_helper(share).allow_access(
+            share_server['backend_details'], share['name'],
+            access['access_type'], access['access_level'], access['access_to'])
+
+    @generic.ensure_server
+    def deny_access(self, context, share, access, share_server=None):
+        """Deny access to the share."""
+        self._get_helper(share).deny_access(
+            share_server['backend_details'], share['name'], access)
diff --git a/manila/tests/share/drivers/windows/test_windows_smb_driver.py b/manila/tests/share/drivers/windows/test_windows_smb_driver.py
index 21151b45..aa27e01a 100644
--- a/manila/tests/share/drivers/windows/test_windows_smb_driver.py
+++ b/manila/tests/share/drivers/windows/test_windows_smb_driver.py
@@ -18,6 +18,8 @@ import mock
 
 import os
 
+from manila.common import constants as const
+from manila import exception
 from manila.share import configuration
 from manila.share.drivers import generic
 from manila.share.drivers.windows import service_instance
@@ -26,6 +28,7 @@ from manila.share.drivers.windows import windows_smb_helper
 from manila.share.drivers.windows import windows_utils
 from manila.share.drivers.windows import winrm_helper
 from manila import test
+from manila.tests import fake_share
 
 
 @ddt.ddt
@@ -37,11 +40,16 @@ class WindowsSMBDriverTestCase(test.TestCase):
                        'WindowsServiceInstanceManager')
     def setUp(self, mock_sv_instance_mgr, mock_smb_helper_cls,
               mock_utils_cls, mock_winrm_helper_cls):
-        self.flags(driver_handles_share_servers=False)
+        self.flags(driver_handles_share_servers=True)
         self._fake_conf = configuration.Configuration(None)
 
+        self._share = fake_share.fake_share(share_proto='SMB')
+        self._share_server = dict(
+            backend_details=mock.sentinel.backend_details)
+
         self._drv = windows_drv.WindowsSMBDriver(
             configuration=self._fake_conf)
+        self._drv._setup_helpers()
 
         self._remote_execute = mock_winrm_helper_cls.return_value
         self._windows_utils = mock_utils_cls.return_value
@@ -273,3 +281,41 @@ class WindowsSMBDriverTestCase(test.TestCase):
             mock.sentinel.server,
             mock.sentinel.mount_path)
         self.assertEqual(expected_result, is_mounted)
+
+    @ddt.data(const.ACCESS_LEVEL_RW, const.ACCESS_LEVEL_RO)
+    def test_allow_access(self, access_level):
+        access = {
+            'access_type': 'ip',
+            'access_to': 'fake_dest',
+            'access_level': access_level,
+        }
+        self._drv.allow_access(
+            mock.sentinel.context, self._share, access,
+            share_server=self._share_server)
+
+        self._smb_helper.allow_access.assert_called_once_with(
+            self._share_server['backend_details'],
+            self._share['name'],
+            access['access_type'], access['access_level'],
+            access['access_to'])
+
+    def test_allow_access_unsupported(self):
+        access = {
+            'access_type': 'ip',
+            'access_to': 'fake_dest',
+            'access_level': 'fakefoobar',
+        }
+        self.assertRaises(
+            exception.InvalidShareAccessLevel,
+            self._drv.allow_access,
+            mock.sentinel.context, self._share, access,
+            share_server=self._share_server)
+
+    def test_deny_access(self):
+        access = 'fake_access'
+        self._drv.deny_access(
+            mock.sentinel.context, self._share, access,
+            share_server=self._share_server)
+        self._smb_helper.deny_access.assert_called_once_with(
+            self._share_server['backend_details'],
+            self._share['name'], access)