SP-2 Firewall with Down.exe

[gwigton]

Hello All,
I am currently using the down.exe tool from LS-Tools to shut my student computers down from the server with the use of bat files for each lab. After doing some testing with XP's SP-2, I have found out that the new firewall updates won't allow my server to shut down the clients. Does anyone know off hand what port Down.exe uses to talk to the clients since I haven't had time to use a port scanner?

 

[bcastner]

As a guess, port 445 for RPC.
But I suspect you have an issue with the Remote Procedure Call service. Prior to SP2 the logon authority for this service was the local system. SP2 changes this to NT Authority\Networking.

You might email the author of Down for advice.

 

[gwigton]

Ok, I have done a couple of things since I posted this.

1. I e-mailed the makers of the Down.exe and after a week I have heard nothing. (I did this before the post)
2. I opened port 445, like bcastner suggested.
3. Bcastner also mentioned he thought this was a logon authority issue, but after doing a little research, I have found that the changes the he referred to actually took place in a HotFix in about mid 2003. I also shut the firewall off, and the Down.exe works. Turn the firewall on and nothing.
4. I ran a port activity program on one of my clients (with the firewall off), but once I execute Down.exe from the server, the client shuts down without enough time for the log to record anything.
5. I read the documentation for Down.exe again. (Gets intersting so keep reading)
6. I ran a port activity program from my server and executed the down.exe for a specific client. SUCCESS

I have found out that it uses port 137 UDP, 138 UDP, and 139 UDP. That's right NetBIOS-ns. So as long as you have the option checked for File and Print Sharing Down works, but my concern is that according to the documentation on down, it is supposed to copy itself, along with NTErr10.dll to the system32 directory and start itself as a service. The problem with that is after doing a search on the client, neither of the files are found and the there is no related service. So either the maker of down has made a newer version than the documentation talks about or they completely lied (I compared my documentation to the latest verion in LS-Tools and they are the same). Please correct me if you find different results than I did because I do like this tool, but for now I may try to find an alternative to Down.exe because I HATE being lied to!!

 

[bcastner]

New: V2.2 does no longer depend on NTErr10.dll and fixes some bugs (see changelog)."

http://www.losoft.de/fs_lstools.html

 

[gwigton]

Ok, I did miss that and I do apologize, but after reading the changelog file, I don't see that it says anything different about downloading the Down.exe to the client:

*************************************************
LSTools V1.5a, 2002-04-09:
* Down.exe V2.2
- Now no longer depends on the NTErr10.dll file
- hibernation works on more non-ACPI machines
- login to remote system works also if account/password contains
non-ASCII7 chars (like German umlauts)
LSTools V1.5, 2001-07-09:
* Added new tool: setenv.exe V1.0
* Down.exe V2.1
- now works also if invoked from services like the task scheduler
- login to remote system now works if down.exe was started as SYSTEM user
- hibernation now also possible on Win2k non-ACPI machines
- new /Copy and /Install commands to bring down.exe to remote machines
* APM.exe V1.1
- now prints also battery remeaning time if provided by the battery
********************************************************
Here are the results of the /C and /I switches

/C[opy] - overrides existing version of down.exe on machine
/I[nstall] - just do a /Copy without shutting down machine

As I said, because I want my point to be clear...I do like the Down.exe tool, and in our environment, I am not concerned that it works the way it actually does. It has really helped, but what I dislike is misrepresenting how it works. I will be the first to say the blame of using it rests completely on my shoulders because I should have tested it further, but what is the point of the documentation if it isn't accurate? Could this be simply a case of poor documentation? I hope so.