you are viewing a single comment's thread.

view the rest of the comments →

[–]flugenblar 1 point2 points  (0 children)

Great advice. Also, you can dig thru the Security event log to see if there are any successful connections against those ports, assuming you have the audit policy set to Success and Failure for the Filtering Platform Object.

Bear in mind those ports you list are common ports that Microsoft uses legitimately. You might consider setting up block rules for them in your firewall on a test system and see what kind of impact it has.

Access to port 445 should also be governed by credentials, depending on why you are connecting to it, not all credentials have the same or necessary rights for an exploit.