Quick Links

: Knowledge Base

:
Patches and Service Packs
: Certification
Resources
: What's New?

: Forums
: Feedback

Read More

Most Popular Articles

:
Forgot the Administrator's Password?
:
Customize the XP Installation
: Windows Update
Problems
:
How to Write ISO Files
:
Change the Serial in Windows XP
:
Download Free Windows 2000 Resource Kit Tools
: Patch
management with GFI LANguard N.S.S. & Microsoft SUS

:
How to Install Active Directory on Windows 2003
:
Install Windows XP Pro
:
How to Install Active Directory on Windows 2000

Read More

Daniel Petri's #1
Picks

: Active Directory Training
: Building Web Servers
: Exchange Server 2003 Training Videos

: Cisco CCNA Video Training
: Virtual Private Networks (VPNs)
: Wireless Networking – CWNA Training

: Network Security Training
: XP Professional Video Training
: Windows 2003 Video Training
: Windows 2003 MCSE Training Videos

Read More

Recent Articles

:
Using OWA 2003 for Storing Files
:
Using OWA 2003 to Recover Deleted Items
:
Configure USB Disks to be Read-Only in Windows XP SP2

:
Disable Automatic Image Resizing in IE 6
:
Remove Manage My Computer Context Menu from My Computer in
2000/XP/2003
: Disable the
RunAs Command
:
Preventing Caching of Failed DNS Lookups
: Meet Adi Petri

:
Office System (2003) SP2 Slipstreaming
: Offline
Address Book Integrity (OABInteg) Utility Explained

Read More

Recent MS Security
Bulletins

: MS05-051
: MS05-050
: MS05-049
: MS05-048
: MS05-047
: MS05-046
: MS05-045
: MS05-044
: MS05-043
: MS05-042

Read More

Recent MS Service
Packs

: Exchange Server 2003 SP2
: Office 2003 SP2
: Windows Server 2003 SP1
: ISA Server 2004 SP1
: Windows XP SP2
: ISA Server 2000 SP2
: Windows 2000 SP4
: Exchange 2000 SP3
: Office XP SP3

Read More

Link to us

Build a Link to Petri.co.il

Read More

Affiliates

Petri.co.il is a
proud member of Culminis

Read More

Microsoft MVP Program

Author is a Windows Server System - Exchange Server
MVP

Read More

By: Daniel Petri

What's port 445 used for in
Windows 2000/XP?

Among
the new ports used by Windows 2000, Windows XP and Windows
Server 2003, is TCP port 445 which is used for SMB over
TCP.

The
SMB (Server Message Block) protocol is used among other things
for file sharing in Windows NT/2000/XP. In Windows NT it ran
on top of NetBT (NetBIOS over TCP/IP), which used the famous
ports 137, 138 (UDP) and 139 (TCP). In Windows 2000/XP/2003,
Microsoft added the possibility to run SMB directly over
TCP/IP, without the extra layer of NetBT. For this they use
TCP port 445.

At its simplest NetBIOS on your
LAN may just be a necessary evil. NetBIOS on your WAN or over
the Internet, however, is an enormous security risk. All sorts
of information, such as your domain, workgroup and system
names, as well as account information is obtainable via
NetBIOS. It really is in your best interests to ensure that
NetBIOS never leaves your network.

If you are using a router as your
Internet gateway then you will want to ensure that it does not
allow inbound or outbound traffic via TCP ports
135-139.

If you're using a Firewall then
you should also block the same ports - TCP ports
135-139.

If you are using a multi-homed
machine i.e. more than 1 network card, then you should disable
NetBIOS on every network card, or Dial-Up Connection under the
TCP/IP properties, that is not part of your local
network.

How to disable NetBIOS over
TCP/IP?

In
Windows 2000/XP/2003 you have the possibility to disable
NetBIOS over TCP/IP. You do this by right-clicking on My
Network Places and selecting Properties. Then right-click on
the appropriate Local Area Connection icon, and select
Properties.

Next,
click on Internet Protocol (TCP/IP) and Properties.

Now
click Advanced, and select the WINS tab.

There
you can enable or disable NetBIOS over TCP/IP.

The
changes take effect immediately without rebooting the system.

You
will get an event in your even log if you do not also disable
the TCP/IP NetBIOS Helper Service service. You can Disable
this service in Control Panel > Administrative Tools >
Services if desired.

Note: Computers that are running an operating
system prior to Windows 2000 will be unable to browse, locate,
or create file and print share connections to a Windows
2000/XP/2003 computer with NetBIOS disabled.

For
more issues on this please read the Disable
NetBIOS in W2K/XP/2003 page.

How to disable port
445?

You
can easily disable port 445 on your computer. To do so follow
these instructions:

Start Registry Editor (Regedit.exe).

Locate the following key in the registry:

HKLM\System\CurrentControlSet\
Services\NetBT\Parameters

In
the right-hand side of the window find an option called
TransportBindName.

Double click that value, and then delete the default
value, thus giving it a blank value.

Close the registry editor.

Reboot your computer.

After
rebooting open a command prompt and in it type

netstat -an

See
that your computer no longer listens to port 445.

Client/Server port
usage

When
does Windows 2000/XP/2003 uses port 445, and when it uses
139?

From
now on I will refer to the "client" as the computer from where
you map drives and other shared resources, and to the "server"
as the computer with resources that are shared. I will also
refer to NetBIOS over TCP/IP only as NetBT.

If the
client has NetBT enabled, it will always try to connect to the
server at both port 139 and 445 simultaneously. If there is a
response from port 445, it sends a RST to port 139, and
continues it's SMB session to port 445 only. If there is no
response from port 445, it will continue it's SMB session to
port 139 only, if it gets a response from there. If there is
no response from either of the ports, the session will fail
completely.

If the
client has NetBT disabled, it will always try to connect to
the server at port 445 only. If the server answers on port
445, the session will be established and continue on that
port. If it doesn't answer, the session will fail completely.
This is the case if the server for example runs Windows NT
4.0.

If the
server has NetBT enabled, it listens on UDP ports 137, 138,
and on TCP ports 139, 445. If it has NetBT disabled, it
listens on TCP port 445 only.

Related
articles

You may find these
related articles of interest to you:

Disable NetBIOS in W2K/XP/2003

Hide a Server from the Microsoft Computer Browser
Service

Install NetBEUI in Windows XP

Registration of NetBIOS Names

Speed Up LAN Browsing in Windows XP

Speed Up Network File Copying in Windows
XP

What's the Microsoft Computer Browser
Service?

up

back

Page updated: 14-10-2005

Quick Search

web

www.petri.co.il

Daniel Petri’s #1 Pick for Computer
Based Training (CBT)

Train Signal offers CBT Videos that
will turn you into a Network Champion! Exchange, Web
Servers, Active Directory, VPNs & more! Watch their Demos now!

Read More

GFI LANguard Network Security
Scanner

Automatically
detect security vulnerabilities on your network with GFI
LANguard Network Security Scanner! Free version available for
download!

Read More

GFI Network Server
Monitor

Automatic network
& server monitoring made easy with GFI Network Server
Monitor! A freeware version available for
download!

Read More

Google Ads

Acunetix Web Vulnerability
Scanner

Check your website security with Acunetix
WVS. Audit your web applications for SQL injection, cross
site scripting & other web attacks. Download
trial!

Read More

Sponsor Our Site

Bandwidth costs are
growing, server hosting is expensive. Help me keep the site
free for all.

Read More

Copyright © 1998 Daniel Petri Ltd.
No portion may be reproduced without my written permission.
Microsoft, MS-DOS, Windows, Windows 2000, Windows XP, Windows Server
2003, Windows NT, Windows 98, Windows 95 are either registered
trademarks or trademarks of Microsoft Corporation in the U.S.A. and
other countries. All other names are registered trademarks of their
respective companies. Should any right be infringed, it is totally
unintentional. Send me an e-mail and I will promptly and gladly
rectify it. All external sites will open in a new browser. MCSEworld
does not endorse external sites and is not responsible for their
content. For broken links, site problems - please send Feedback.