Port 445SMB (file sharing)

What port 445 is used for

SMB is the protocol behind \\server\share. Over port 445 it provides:

• File and printer sharing, mapped drives, net use.
• Delivery of Group Policy and logon scripts from the SYSVOL and NETLOGON shares on domain controllers.
• Administrative shares (C$, ADMIN$) used by remote management and deployment tools.
• Named pipes that carry RPC for services such as the Service Control Manager, the registry and the print spooler.
• Hyper-V and SQL Server storage on SMB 3 file shares.

Every Windows machine listens on 445 by default because the Server service is always installed.

SMB versions

Security considerations

Port 445 has been the vehicle for the most damaging worms of the past two decades (Conficker, WannaCry, NotPetya). The lessons are consistent:

• Block 445 at the internet edge in both directions. Inbound to stop attacks; outbound to prevent credential leakage, since Windows will happily send NTLM authentication to any server it is tricked into contacting.
• Disable SMB 1. Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol shows whether it is present.
• Require SMB signing and enable SMB encryption for shares carrying sensitive data.
• Segment. Workstations rarely need to reach each other on 445; allow it to file servers and domain controllers only.
• Patch. SMB vulnerabilities are wormable by nature.

How to check port 445

Is something listening locally? On Windows, open Command Prompt and run:

netstat -ano | findstr :445

A line in the LISTENING state means a local program has bound port 445; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :445 or lsof -i :445.

Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:

Test-NetConnection fileserver01 -Port 445

TcpTestSucceeded : True means the remote system accepted a TCP connection on port 445. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.

See the netstat and Test-NetConnection records for the full option sets.

Check which SMB version a connection negotiated:

Get-SmbConnection

The Dialect column shows 3.1.1 on current systems. Get-SmbServerConfiguration shows whether signing and encryption are required on the local server.

Firewall considerations

The "File and Printer Sharing (SMB-In)" rule is enabled on the Private and Domain profiles when network discovery or sharing is turned on, and disabled on Public. Keep it that way, scope it to the local subnet where possible, and never forward 445 on a router.

On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 445 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.