computer management to PC w/SP2 and Win Firewall

[klklkl]

I've got 7 PCs on our local network with Windows Firewall turned on. I'd like to use the Computer Management app to look at and admin services, view Event Log, etc, but I'm being blocked by the firewall. The following exceptions are checked on the firewall settings:

File and Printer Sharing
Remote Assistance
UPnP Framework

Also, IGMP incoming echo requests is checked too.

Anyone know what kind of exception needs to be added to allow Computer Management to work over the network to these PCs? I see in other posts here that the firewall blocks a lot of spyware and other things, but it seems like it may be more trouble than it is worth inside a corporate network.

 

[PoliMalaka]

My experience is that unless you are on the Internet (not behind a firewall) the WIndows firewall only creates problems. Get a firewall for your network, some top notch AV software, crank your users to the Users group (if possible) and open them PCs up. To go to a desktop each and everytime is a P-A-I-N.I'll be interested to know what the tweaks are.

 

[bcastner]

How do I resolve these issues?

To use these tools to remotely connect a computer running Windows XP with Windows Firewall enabled, you need to open TCP port 445 in the firewall on the remote computer. To do this, use the following procedure:

1. Click Start, point to All Programs, point to Accessories, and click Command Prompt.

2. At the command prompt, type netsh firewall set portopening TCP 445 ENABLE and then press ENTER.

Note Open firewall ports can be a security vulnerability. You should carefully plan and test any such configuration change before it is implemented.

 

[linney]

Make sure your settings are correct and that you are not being blocked from accessing the machines from your Network.

The exceptions you mention above can be adjusted via the "Edit" and "Change Scope" to allow access from other computers.

http://www.microsoft.com/technet/community/columns/cableguy/cg0204.mspx

 

[bcastner]

You cannot just change scope; port 445 has to be opened.

For the administrative tools that are listed here to connect to a remote computer, that remote computer must allow incoming network traffic on TCP port 445. However, the default configuration of Windows Firewall in Windows XP Service Pack 2 blocks incoming network traffic on TCP port 445. As a result, you might receive one or more of the following error messages. When you receive one of these messages, the text that is italicized in the example messages below will be replaced with the system variable appropriate to the error condition:

• Unable to access the computer Computer_Name. The error was Access is denied.
• Unable to access the computer Computer_Name. The error message previously said The network path was not found.
• Failed to open Group Policy object onComputer_Name. You might not have appropriate rights.
• Details: The network path was not found.
• An object (Computer) with the following name cannot be found: “Computer_Name.” Check the selected object types and location for accuracy and ensure that you have typed the object name correctly, or remove this object from the selection.
• Computer Computer_Name cannot be managed. The network path was not found. To manage a different computer, on the Action menu, click Connect to another computer.
• System error 53 has occurred. The network path was not found.

These errors can occur when one of the following MMC snap-ins is used for remote administration:

• Certificates

• Computer Management

• Device Manager

• Disk Management

• Event Viewer

• Group Policy

• Indexing Service

• IP Security Monitor

• IP Security Policy

• Local Users & Groups

• Removable Storage Management

• Resultant Set of Policy

• Services

• Shared Folders

• WMI Control


In addition to the MMC snap-ins, these dialog boxes and administrative tools are affected:

• Select Users, Computers, or Groups

• Find Users, Contacts, and Groups

• Net.exe


How do I resolve these issues?

To use these tools to remotely connect a computer running Windows XP with Windows Firewall enabled, you need to open TCP port 445 in the firewall on the remote computer.

http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2chngs.mspx

 

[bcastner]

I should note as a follow-on to linney's comment, that if you have made an exception for File and Printer Sharing, you have also by default opened up port 445 TCP through the firewall.

 

[klklkl]

I did have and exception checked for File and Printer Sharing, but I could not access via Computer Management. I did run the command listed above on these PCs, and I can now manage them. Thanks!

 

[bcastner]

You are welcome.