Port 445 · TCP
SMB (Server Message Block, direct over TCP)
IANA service name: microsoft-ds
Criticalrisk if open to the internet
Internet-facing? Never expose it to the internet.
- What normally runs on it
- Windows file and printer sharing, named pipes and admin shares (ADMIN$, C$, IPC$). Every Windows machine with the Server service running listens here, and so do Samba servers and many NAS boxes. Domain controllers need it for Group Policy (SYSVOL and NETLOGON).
- Why it is risky if exposed
- SMB is an authenticated protocol that reaches straight into the file system and inter-process communication, and the Windows SMB server has a history of pre-authentication remote code execution bugs. Reachable from the internet it also invites password spraying, NTLM relay and data theft from open shares. Because almost every Windows machine runs it, one flaw becomes a worm path: whoever reaches 445 reaches everything that listens on it.
- Known incidents
- EternalBlue (CVE-2017-0144, fixed in MS17-010, March 2017) was an SMBv1 remote code execution bug that needed no login. The WannaCry ransomware worm (May 2017) and NotPetya (June 2017) used it to spread host to host over port 445. SMBGhost (CVE-2020-0796, March 2020) was a pre-authentication bug in SMBv3.1.1 compression on Windows 10 and Server versions 1903 and 1909.
- Safer alternative
- For remote file access use a VPN or ZTNA, a managed file-sync or cloud file service, or SMB over QUIC: SMB inside a TLS 1.3 tunnel on UDP 443, supported by Windows Server 2025 (any edition) and Windows Server 2022 Datacenter: Azure Edition, with Windows 11 clients. Microsoft also advises blocking TCP 445 outbound to the internet.
Hardening checklist
- Block TCP 445 inbound from the internet at the edge firewall and the cloud security group. Microsoft also recommends blocking it outbound to the internet unless you need a specific cloud service such as Azure Files.
- Remove SMBv1. It is the dialect EternalBlue attacked. It is not installed by default on Windows 10 version 1709, Windows Server version 1709 and later, but upgraded or older machines may still have it.
- Require SMB signing (it blocks NTLM relay) and use SMB encryption for sensitive shares. Windows 11 24H2 and Windows Server 2025 require signing by default in more cases than older versions.
- Patch Windows monthly; SMB bugs are among the ones attackers weaponise fastest.
- Segment: workstations rarely need to accept SMB from other workstations. Use the host firewall so only file servers and domain controllers accept 445, and only from the subnets that use them.
- If a machine does not share anything, stop and disable the Server (LanmanServer) service.
Check and harden it
Check the SMB server settings (PowerShell, as admin)
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol, EnableSMB2Protocol, RequireSecuritySignature, EncryptDataTurn SMBv1 off on the server side
Set-SmbServerConfiguration -EnableSMB1Protocol $false -ForceRemove the SMBv1 feature (Windows client / Windows Server)
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol
Uninstall-WindowsFeature -Name FS-SMB1Require SMB signing
Set-SmbServerConfiguration -RequireSecuritySignature $true -ForceIs anything listening on 445 here?
Get-NetTCPConnection -LocalPort 445 -State ListenTest from OUTSIDE your network, against your own public IP
Test-NetConnection <your-public-ip> -Port 445
nmap -Pn -p 139,445 <your-public-ip>Samba (smb.conf): no SMB1, no port 139
[global]
server min protocol = SMB2
smb ports = 445
server signing = mandatoryReady-to-copy block rule
sudo iptables -I INPUT -p tcp --dport 445 -j DROP
sudo ip6tables -I INPUT -p tcp --dport 445 -j DROPInserts a drop rule at the top of INPUT for IPv4 and IPv6 on this host. On a Linux router or gateway, use the FORWARD chain instead. Save it (netfilter-persistent save, or your distribution's equivalent) or it is lost on reboot.