How to close the 445 port? 445 port closing steps and precautions

in the field of cyber security, ports are the key channels for devices to interact with external networks. Port 445, as the default port of the SMB protocol, used to play an important role in file sharing on local area networks, but now it has become the main attack entrance for malicious programs such as ransomware. Many users have encountered security problems such as data encryption and device loss due to ignoring the protection of port 445. This article will dismantle the security risks of port 445, share the closing steps in different scenarios, and the details to pay attention to after closing, to help you build a cyber security defense line.

Why should I close port 445?

understand the need to close port 445, it is first necessary to understand the role and risks of this port.

1, the core role of the 445 port

445 port is the default transfer port of SMB protocol in Windows system, which is mainly used for file sharing, printer sharing in local area network, and communication between domain controllers. In the early local area network office scene, port 445 allows users to quickly share resources and improve work efficiency, but with the complexity of the network environment, the risk of its open state is gradually highlighted.

2, 445 port security risks

recent years, a large number of ransomware viruses such as WannaCry, Petya, etc. are launched by scanning open 445 ports and exploiting the vulnerabilities of the SMB protocol. Once the 445 port of the device is open and the system vulnerabilities are not repaired in time, malicious programs can easily invade the device, encrypt user data and demand ransom, causing serious property damage and data leakage risks to individuals and enterprises.

2. Windows system closes port 445

different versions of Windows systems, the operation logic of closing port 445 is roughly the same, but the specific steps are slightly different.

1, close port 445 through the firewall

this is the most commonly used way to close, suitable for Windows 7, Windows 10, Windows 11 and other mainstream systems. First open the control panel, find the Windows Defender firewall, click "Advanced Settings" to enter the rule configuration interface; then select "Inbound Rules", click "New Rule" on the right, select "Port" in the rule type, next check "TCP" and enter a specific local port "445"; then select "Block Connection", check the three network environments of domain, private and public network in turn, and finally name the rule such as "Close Port 445" and complete the configuration.

2, close port 445 through regedit

this method can disable port 445 from the bottom layer of the system, suitable for users who have a certain understanding of system operation. Press the Win + R key combination to open the running window, enter "regedit" to enter the regedit editor; expand the path in turn HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Services\ NetBT\ Parameters, right-click in the right blank to create "DWORD (32-bit) value", named "SMBDeviceEnabled", set its numerical data to "0" and restart the computer to completely disable port 445.

3. What are the precautions after closing port 445?

closing port 445 can effectively reduce security risks, but it will also affect some functions. Knowing the precautions in advance can avoid unnecessary trouble.

1, LAN sharing function is limited

Since port 445 is the core port of the SMB protocol, the default file and printer sharing functions of the Windows system will not work normally after closing. If you still need to share on the local area network, you can use the FTP protocol or third-party sharing tools, or you can set the firewall to allow only specific IP access to port 445 to find a balance between security and convenience.

2, it is necessary to regularly check the status of port 445

some system updates or software installations may automatically open port 445, so check the port status regularly after closing. You can enter "netstat -ano | findstr: 445" through the command prompt to see if the port is open. If the port is found to be reopened, check the reason and close it again in time to ensure that the protection effect continues to be effective.

4. How to confirm that port 445 has been successfully closed?

close port 445, it is necessary to verify whether the operation is successful through professional methods to avoid the port remaining open due to operation errors.

1, use system commands to detect

press the Win + R key combination to open the running window, enter "cmd" to start the command prompt, and enter "netstat -ano | findstr: 445" in the window. If there is no return result, it means that port 445 has been closed locally. If there is a return result, you need to record the PID value, open the task manager to find the corresponding process, and determine whether it is a necessary process. If not, you can close port 445 again after ending the process.

2, remote detection with online tools

In addition to local detection, you can also enter the public Internet Protocol Address of the device and select port 445 to scan through online port scanning tools such as Webmaster Tools, Alibaba Cloud Port Detection, etc. If the tool shows port "closed" or "not open", it means that the closure operation of port 445 has taken effect, and the external network cannot access the device through this port.

sum up, although port 445 used to be a convenient channel for LAN sharing, it has now become a high-risk entry point for network attacks. By closing port 445 through firewall or regedit, it can effectively resist malicious attacks such as ransomware viruses. At the same time, it is necessary to pay attention to the alternatives of LAN sharing functions, and regularly check the port status to confirm the closure effect. As long as you master the correct operation methods and protection details, you can maintain the basic needs of daily network use under the premise of ensuring cyber security.