I needed to block port 135 and 445 on Window Server 2008 R2 due to WannaCry . Having done it, workstations could not access the shared folders on the server. Is it possible to configure the file share management with another port? So users can still access the shared folder even the two ports have been blocked.
Band-Aids don't fix security vulnerabilities
The real problem here is that your computers have a serious security vulnerability. Blocking ports 135 and 445 serves as a Band-Aid to the problem. While doing this may be a viable temporary solution to do damage control, the proper solution is to install the patch throughout your environment.
Blocking ports 135 and 445 has the effect of disabling SMB file-sharing on your Windows Server. If your boss is asking you to do this to "fix" the threat posed by WannaCry, then you should make your boss aware that this is the equivalent of deleting your e-mail address in order to avoid getting spam messages.
Suppose you don't need file sharing enabled. Fine. But by leaving this vulnerability unpatched you arm an explosive land-mine that will make a fantastic mess of your organization the day someone comes along and re-enables file sharing. Don't do this.
Always install security patches, even if you don't currently use the patched service.
As mentioned in Twisty's answer, this idea of your "senior" colleague's like deleting your email address to prevent spam. Yeah, that would prevent spam, but it also prevents legitimate use of the service.
In actuality, there are three mitigations to this particular piece of malware.
- Apply the relevant patch on your systems.
- Disable SMB v1, which is the protocol that the EternalBlue vulnerability exploits.
- This is actually pretty easy, and for most use-cases, SMB v1 shouldn't be used anyway. The newer versions of the protocol are [much] faster and more secure.
Disable-WindowsOptionalFeature -Online -FeatureName smb1protocol
- Block the ports that SMB uses.
- This prevents the malware from spreading by disabling the file sharing vector it uses to spread, which means it also prevents legitimate uses of Windows file sharing.
- Note that changing the default port doesn't really solve the problem - this malware uses SMB v1 to spread. If you just change the port for your SMB traffic without patching or disabling SMB v1, you're still exposed to the EternalBlue vulnerability that this malware uses. This particular piece of malware may or may not be stopped by changing the port, but the underlying vulnerability would still be exposed.