In tip 7907, I used the netsh firewall set portopening TCP 445 ENABLE to open TCP port 445.

In Appendix B of Deploying Windows Firewall Settings for Microsoft® Windows® XP with Service Pack 2, Microsoft describes the Netsh Command Syntax for the Netsh Firewall Context which begins with:

The following Netsh commands can be used in scripts or at the command line to configure Windows Firewall for IPv4 and IPv6 traffic when executed from the netsh firewall context:

•	add allowedprogram                              •	set allowedprogram                              •	delete allowedprogram                              •	set icmpsetting                              •	set multicastbroadcastresponse                              •	set notifications                              •	set logging                              •	set opmode                              •	add portopening                              •	set portopening                              •	delete portopening                              •	set service                              •	show
Microsoft describes the set portopening context as follows:
                              Used to modify the settings of an existing open TCP or UDP port.                              Syntax:                              set portopening                                    \[ protocol = \] TCP|UDP|ALL                                    \[ port = \] 1-65535                                    \[ \[ name = \] name                                      \[ mode = \] ENABLE|DISABLE                                      \[ scope = \] ALL|SUBNET                                      \[ profile = \] CURRENT|DOMAIN|STANDARD|ALL                                      \[ interface = \] name \]                                protocol - The protocol.                                    TCP                                    UDP                                    ALL - All protocols.                                port - The port.                                name - The friendly name.                                mode - The mode. If no mode is specified, ENABLE is assumed.                                    ENABLE  - Enforced by the firewall.                                    DISABLE - Not enforced by the firewall.                                scope - The scope. If no scope is specified, SUBNET is assumed.                                    ALL    - All traffic will be allowed.                                    SUBNET - Only local subnet traffic will be allowed.                                profile - The profile. If no profile is specified, CURRENT is assumed.                                    CURRENT   - The current profile.                                    DOMAIN - The domain profile.                                    STANDARD     - The standard profile.                                    ALL       - All profiles.                                interface - The friendly name of the interface from Network Connections.                                NOTE: The profile and scope parameters may not be used if specifying the interface                                       parameter.