How to safely block or scope TCP 445 port number. TCP port 445 can expose SMB services and networks to ransomware, credential theft, and other exploits. In this video, you'll learn a step-by-step framework to safely block or scope TCP port 445 without breaking domain operations or file transfers. Before we begin, be sure to subscribe to NinjaOne's IT Video Hub and our YouTube channel for more tech content like this. What is SMB and TCP 445 port number? Server message block, or SMB, lets computers share files, printers, serial ports, and other resources over a network. Modern SMB traffic runs directly over TCP port 445. Blocking TCP port 445 might seem like the obvious fix, but it can disrupt domain operations and file transfers. How to secure TCP 445 port number. Step one: identify where SMB is required. Start by identifying file servers, domain controllers, print servers, and admin shares that need to stay reachable. Track the client groups that legitimately access them, as well as remote use cases with alternatives like a VPN or SMB over QUIC where supported. Step two: block TCP 445 at the perimeter and untrusted zones. Block inbound and outbound TCP 445 at your firewall or cloud edge to reduce exposure to internet-based scanning, exploitation, credential theft, and data exfiltration. Before blocking outbound traffic, identify any required cloud service exceptions. Prevent untrusted segments like guest Wi-Fi, IoT networks, and BYOD devices from communicating with corporate SMB services. Use host firewall rules to block inbound SMB unless the device is on a trusted domain network. Step three: scope internal access with least privilege. Create Windows Defender Firewall rules that allow TCP port 445 only between approved client subnets and approved SMB hosts. Use group-based policy targeting for exceptions. Maintain an explicit allow list, then deny all other 445 traffic within the LAN and across intersite links. Step four: harden SMB before and after blocking. Harden SMB to reduce successful authentication and relay attempts, even on paths you haven't blocked yet. Disable SMB 1.0 across all your systems and require SMB signing where supported, after checking compatibility with legacy and third-party SMB services. Review your domain controller and file server settings and use SMB over QUIC for remote scenarios to avoid exposing TCP port 445 to the internet. Step five: deploy rules via GPO or MDM. Use GPO or MDM to roll out inbound and outbound rules to a small pilot group first. Enable detailed firewall logging and document the rules, their precedents, and any exceptions. Also, keep a tested rollback script ready so you can remove or relax rules quickly if something breaks. Step six: verify and monitor your changes. Test network reachability with test net connection dash computer name dash port 445 and validate file share access, GPO processing, and authentication where applicable. Review firewall logs for denials, especially events that line up with help desk tickets. Then, adjust your allow lists based on what you observe. Step seven: govern exceptions and lifecycles. As part of ongoing maintenance, continue to document the owner, reason, and expiry date for every 445 exception. Review those exceptions on a monthly basis and tighten or remove them whenever possible. Protect your network with safety measures for TCP 445. With this framework, you should be able to reduce the risks associated with SMB and TCP port 445 without breaking the file shares, group policy processing, and other domain and management workflows your organization depends on every day. For more information, check out our official blog post on how to reduce SMB risk: safely block or scope TCP 445 in Windows, linked in the description below.