Sharing is on, permissions are right, the password works — and the connection still dies at the door. The host's firewall never got the message that file sharing is allowed in.
Firewall problems in file sharing have one defining feature: silence. No error names the firewall, because dropping a connection is what firewalls do without comment. So this diagnosis is by elimination — address fine, profile Private, credentials accepted nowhere because the request never lands. The fix lives on the host PC, in one rule group named File and Printer Sharing (SMB-In). This page checks it the simple way, then the certain way, then deals honestly with the third-party suites that override both.
A shared folder is an incoming connection to the PC that holds it. So the firewall that decides its fate is the host's firewall, examining traffic arriving at TCP port 445 — the SMB port. The firewall on your own PC, the one reaching out, almost never blocks this: outbound connections are allowed by default. This is why days of 'firewall fixes' on the wrong machine change nothing.
Go to the host. Everything on this page happens there.
On the host, open Windows Defender Firewall from Control Panel and click Allow an app or feature through Windows Defender Firewall. Find File and Printer Sharing in the list and confirm the box is ticked in the Private column. If your network is set to Private (it must be, for sharing) and this box is unticked, you have found the whole problem.
If the tickboxes are greyed out, click Change settings first — you need administrator rights on the host. On a work PC managed by IT, this grey state is policy, and the correct move is a ticket, not a workaround.
For certainty, open the advanced console: press Windows + R and run wf.msc. Open Inbound Rules and find the group named File and Printer Sharing (SMB-In). At least the rule for the Private profile should be Enabled — a green tick, TCP, port 445. If the whole group is disabled, enable the Private-profile rule.
Do not create your own custom 'open port 445' rule on top. Duplicates make future troubleshooting miserable, and the built-in rule is scoped to the right profiles and addresses. Use the rule Windows ships; just switch it on.
Many antivirus suites install their own firewall and quietly take over from Windows Defender Firewall — which then shows your correct settings while another program does the actual blocking. If the SMB-In rule is enabled and sharing still fails, look for the suite's own firewall or 'network protection' module and check whether it has a file-sharing or 'trusted network' setting, or whether it classified your network as untrusted/public on its own scale.
The honest test: for two minutes only, pause the third-party firewall (never uninstall anything) and test the folder. If it opens instantly, you have your culprit and your next step is to configure that product's trusted-network setting properly — then turn it back on. A test that ends with the firewall permanently off is not a fix; it is an exposure.
File sharing needs exactly one door: TCP 445, on the Private profile, from your local network. Advice that tells you to also open the old NetBIOS ports (137–139) is advice from the SMB1 era — leave them closed. And port 445 must never be forwarded from your router to a PC: exposing SMB to the internet is one of the oldest, most reliably exploited mistakes in home networking. Sharing is a local-network feature; remote access belongs behind a VPN, full stop.
Every check in this guide, shown live on a real Windows 11 PC — the complete network folder fix, step by step.
▶️ Watch Full VideoAlmost never. Outbound SMB from your PC is allowed by default in Windows Firewall. Only unusual third-party security setups block outbound sharing traffic. Spend your effort on the host, where the incoming rule lives.
Check in order: is the host's network profile actually Private (the rule is profile-scoped), is a third-party firewall overriding Windows', and does a ping to the host succeed at all? If ping fails on a Private network, the host may also be blocking ICMP — but SMB is the test that matters: try the folder by IP address.
On the Private profile, from your local network, with password-protected accounts — yes, that is the designed configuration. The danger is never the feature itself; it is enabling it on Public profiles, for the whole internet, or alongside passwordless accounts.