SEPM cannot login to computers to detect SEP

Hi,

I have question about search network client, I use client deployment wizard to scan client in SEPM 12.1

Client is joined domain, OS is win7. If I enable windows firewall from client. SEPM cannot detect client, result as below:

Image may be NSFW.
Clik here to view.

But when I disable client windows firewall, SEPM can detect client, result as below:

Image may be NSFW.
Clik here to view.

So it is because of windows firewall. I have open TCP 139, 445 and UDP 137, 138. but it still fail.

Does anyone know which port should be open? Thanks.