Is port 445 putting you at risk? SMB exposure self-check

Deny inbound TCP 445 and TCP 139, and UDP 137-138, from any external source on every internet edge: office firewalls, cloud security groups and network ACLs, and any port-forward on a branch router. Remove the port-forward or public IP that exposed it rather than only adding a deny rule above it.

# Rule intent for any firewall (adapt to your vendor syntax):
deny  inbound  tcp  any -> any  port 445
deny  inbound  tcp  any -> any  port 139
deny  inbound  udp  any -> any  port 137-138

# AWS: find security groups that allow 445 from anywhere
aws ec2 describe-security-groups \
  --filters Name=ip-permission.from-port,Values=445 Name=ip-permission.cidr,Values=0.0.0.0/0 \
  --query "SecurityGroups[].GroupId"

Source: CISA: SMB Security Best Practices, CISA: Alert TA17-132A: Indicators Associated With WannaCry Ransomware, Microsoft: Secure SMB Traffic in Windows Server

Turn on SMBv1 auditing for a couple of weeks to see which devices still use it (event ID 3000 in Microsoft-Windows-SMBServer/Audit), fix or replace them, then remove SMBv1. Removing the optional feature restarts the machine.

# Is SMBv1 on?
Get-SmbServerConfiguration | Select EnableSMB1Protocol

# Log who still uses it before switching off
Set-SmbServerConfiguration -AuditSmb1Access $true

# Turn off the SMBv1 server (no restart)
Set-SmbServerConfiguration -EnableSMB1Protocol $false

# Remove the SMBv1 feature on Windows 8.1 / 10 / 11 (restarts)
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

Source: Microsoft: Detect, enable, and disable SMBv1, SMBv2, and SMBv3 in Windows, Microsoft: Security Bulletin MS17-010 (Critical)

Set it by Group Policy (Microsoft network server / client: Digitally sign communications (always)) or PowerShell. Devices that cannot sign will fail to connect: fix or replace them rather than switching signing back off. Requiring signing also ends guest access.

Set-SmbServerConfiguration -RequireSecuritySignature $true
Set-SmbClientConfiguration -RequireSecuritySignature $true

# check
Get-SmbServerConfiguration | FL RequireSecuritySignature
Get-SmbClientConfiguration | FL RequireSecuritySignature

Source: Microsoft: Control SMB signing behavior

Connect to shares by DNS name, not IP address, so Kerberos is used. On Windows 11 24H2 and Windows Server 2025 clients, block NTLM for SMB and add exceptions (Group Policy: Block NTLM Server Exception List) for the few non-domain servers that still need it.

Set-SmbClientConfiguration -BlockNTLM $true

# per mapping
New-SmbMapping -RemotePath \\server\share -BlockNTLM $true

Source: Microsoft: Block NTLM connections on SMB, Microsoft: Control SMB signing behavior

Workstations rarely need to accept SMB. Block inbound 445 on workstations by GPO-deployed firewall rules, allowing it only on file servers and domain controllers, and disable the Server service on machines that share nothing (test first: some management tools use admin shares).

# On a workstation that should not serve files (test before rolling out)
Set-Service -Name LanmanServer -StartupType Disabled
Stop-Service -Name LanmanServer -Force

Source: Microsoft: Secure SMB Traffic in Windows Server, CISA: Alert TA17-132A: Indicators Associated With WannaCry Ransomware

Deny TCP 445 outbound at the corporate firewall. If you use a cloud file service over SMB (for example Azure Files), allow only its published address ranges, ideally through a VPN.

deny  outbound  tcp  internal -> internet  port 445
# exception, only if needed: allow to the cloud file service's published ranges

Source: Microsoft: Secure SMB Traffic in Windows Server

SMB 3 encryption protects data on untrusted network segments. Turn it on per share for sensitive data, or server-wide once every client supports SMB 3.

Set-SmbShare -Name "Finance" -EncryptData $true
# or server-wide
Set-SmbServerConfiguration -EncryptData $true

Source: Microsoft: Detect, enable, and disable SMBv1, SMBv2, and SMBv3 in Windows

From a host outside your network (a cloud VM or a phone hotspot), test your own public IPs, and repeat after every firewall change. Only scan addresses you own or are authorised to test. Searching your own ranges on internet-scan search engines also shows what they have seen.

# from OUTSIDE your network, against your own public IP
nmap -Pn -p 139,445 203.0.113.10
# "filtered" or "closed" is what you want; "open" means exposed

Source: Microsoft: Secure SMB Traffic in Windows Server

List which servers must accept SMB and from where. Audit file share access (Advanced Audit Policy > Object Access > File Share, event 5140) for a set period to see who connects, and review the list after each change.

Get-SmbShare
Get-SmbSession | Select ClientComputerName, ClientUserName, Dialect

Source: Microsoft: Secure SMB Traffic in Windows Server

Alert on SMBv1 connection attempts (event 3000 once auditing is on), inbound 445 hits on the perimeter firewall, outbound 445 attempts, and workstation-to-workstation SMB. Each one is either a misconfiguration or an attacker.

Source: Microsoft: Detect, enable, and disable SMBv1, SMBv2, and SMBv3 in Windows, Microsoft: Secure SMB Traffic in Windows Server