diff --git a/ansible/vars/protected.yml b/ansible/vars/protected.yml
index ebb11cb..83ea0a0 100644
--- a/ansible/vars/protected.yml
+++ b/ansible/vars/protected.yml
@@ -51,7 +51,8 @@ remote_group_rules:
   - { direction: "egress", protocol: "tcp", port_min: 464, port_max: 464, group: "domain_member", remote_group: "domain_controller", comment: "Kerberos password change TCP"}
   - { direction: "egress", protocol: "tcp", port_min: 135, port_max: 135,  group: "domain_member", remote_group: "domain_controller", comment: "RPC"}
   - { direction: "egress", protocol: "udp", port_min: 137, port_max: 138,  group: "domain_member", remote_group: "domain_controller", comment: "NetBIOS"}
-  - { direction: "egress", protocol: "tcp", port_min: 445, port_max: 445, group: "domain_member", remote_group: "domain_controller", comment: "SMB"}
+  - { direction: "egress", protocol: "tcp", port_min: 445, port_max: 445, group: "domain_member", remote_group: "domain_controller", comment: "SMB -> DC"}
+  - { direction: "egress", protocol: "tcp", port_min: 445, port_max: 445, group: "domain_member", remote_group: "file_server", comment: "SMB -> FS"}
   - { direction: "egress", protocol: "tcp", port_min: 636, port_max: 636, group: "domain_member", remote_group: "domain_controller", comment: "LDAPS"}
   - { direction: "egress", protocol: "tcp", port_min: 3268, port_max: 3269, group: "domain_member", remote_group: "domain_controller", comment: "Global catalog"}
   - { direction: "egress", protocol: "udp", port_min: 123, port_max: 123, group: "domain_member", remote_group: "domain_controller", comment: "W32Time"}