> Source: [sk184973](https://support.checkpoint.com/results/sk/sk184973)

# sk184973 - Endpoint Security Blocks Inbound SMB Access After Ransomware Detection (SMB Containment)

| Property | Value |
|----------|-------|
| Solution ID | sk184973 |
| Date Created | 2026-05-19 |
| Last Modified | 2026-07-15 |
| Technical Level | Advanced |
| Products | Endpoint Security |
| Versions | E89.X |
| OS | Windows |

## Symptoms

- * The Endpoint Security management console shows an SMB Isolation Changed event for an endpoint, indicating that inbound SMB access has been blocked
* Users on the network can no longer access file shares hosted on the affected endpoint (mapped drives and UNC path access fail)
* Windows Defender Firewall contains new inbound rules named ` CheckPoint.SmbContainment.Block.In.*`.
* The endpoint's outbound connectivity, including its ability to access other SMB shares, is not affected.

## Cause

Check Point Endpoint Security detected an active ransomware attack on this endpoint that originated from the network over an SMB share. To prevent the encryption from spreading laterally, Endpoint Security automatically activated **SMB Containment**. SMB Containment blocks all inbound SMB and NetBIOS traffic to the endpoint. Outbound connectivity is not affected.  
Note: This article does not apply when Check Point Endpoint Firewall is installed.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content