unusual port 445 connections

Posted on 2004-11-11
Last Modified: 2012-05-05
I'm running a member server in an AD domain that functions like the domain controller for my workgroup.  In other words, the workstations connect to the server for file sharing, but the server itself isn't at the top of the AD domain, just a member server in my delegated OU.  Anyway, I try to restrict access to the workstations and the server as much as possible, but I'm relatively new to all of this so I have to utilize a guess-and-check method more often than not.

I've noticed that the member (win 2k3) server has connections that I thought were blocked.  In the GPO for the server, I allow acces to the computer from only the computers in my OU and the DC (obviously), and I only allow logins from my OU users.  That being said, I find connections with netstat -a that are connecting to port 445 from unauthorized computers.  Since the computers in question aren't authorized to log in, nor to access the computer from the network, I'm wondering how TCP/IP connections can be established at all, even if they aren't showing up as attempted logins in the security log.  

I also notice that another member server in the domain is able to login (according to the security log) as ANONYMOUS LOGON, even though anonymous connections are forbidden (the DC logs in that way as well, but that doesn't bother me because I can't override the DC's authority).  I've never had any formal training in network administration, and while I can keep things running fine, I'm frustrated at some of the confusing hair-splitting involved here.  I don't believe my server is being hacked, but I also don't know why systems other than the DC and the workstations in my OU are connecting when only the latter two were granted access.  

Question by:Zeek0
    1 Comment
    LVL 8

    Accepted Solution

    could these be outbound connections from the server itself?  check and see if the "automatically search for network folders and printers" setting under folder options is turned off on the server... also.. you may want to use an ip security policy to allow only the computers you want to access the server access...  the 445 connections could the client systems attempting to search for network folders and printers as well... they would be able to initiate and establish a 445 session but just wouldn't be able to authenticate... although... being as the member server is on the same playing field as a member workstation the system accounts should still be able to authenticate on the server... users wouldn't be able to access the resources though unless they ran a script as the system account on their workstation....  ofcourse... an ip security policy would prevent even these connections...

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    Join & Write a Comment

    Suggested Solutions

    Lets look at the default installation and configuration of FreeProxy 4.10 REQUIREMENTS 1. FreeProxy 4.10 Application - Can be downloaded here ( 2. Ensure that you disable the windows fi…
    Configuring network clients can be a chore, especially if there are a large number of them or a lot of itinerant users.  DHCP dynamically manages this process, much to the relief of users and administrators alike!
    Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

    729 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now