Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am a Jr Admin of a company who's boss seems to think its a good idea to get local admin rights to all users... I can't win until i take his job. We have some users who set the firewalls to disable all connections coming in.

How can I remotely reconfigure these firewalls without their knowledge?

Failed attempts below!

S:>net use \\IPC$ "password" /user:domain\username The command completed successfully.

S:\pstools>sc \ pause "Windows Firewall/Internet Connection Sharing (ICS)" [SC] OpenSCManager FAILED 1722:

The RPC server is unavailable.

S:\pstools>telnet \ 135 Connecting To \ not open connection to the host, on port 13 5: Connect failed

S:\pstools>psservice \ -u domain\username -p password stop "Windows Firewall/Internet Connection Sharing (ICS)"

PsService v2.21 - Service information and configuration utility Copyright (C) 2001-2006 Mark Russinovich Sysinternals -

Unable to access Service Control Manager on \ The RPC server is unavailable.

Sure I could drive out grab the machine, do some things to get me fired to have things done correctly, but i'm looking for a simpler way to get this done.

share|improve this question
up vote 7 down vote accepted

Group Policy is the best answer for this. All of the firewall settings can be set and enforced through this method.

share|improve this answer
Unfortunately most of these machines are remote, without DCs to connect to. The GPO would push to the machine, but they would have full access to edit the firewall settings after its said and done. – XTZ Jun 3 '09 at 18:39
No, they won't. The group policy push for Firewall settings can be set to disable the users' ability to change those settings. – Kevin Kuphal Jun 3 '09 at 18:57
Sounds like this is the best route then. Thanks guys. – XTZ Jun 3 '09 at 19:27

Two words: Group Policy

share|improve this answer
Group policy can't be overriden by a local admin? – Michael Todd Jun 3 '09 at 18:38
It can, but not without some amount of magic. – grawity Jun 3 '09 at 18:39
@Michael absolutely not. Domain admin trumps local admin. – Kara Marfia Jun 3 '09 at 18:40
That's great to know! – Michael Todd Jun 3 '09 at 18:43
With group policy you can completely grey out the ability for them to change the settings at all. We have Windows Firewall turned off via group policy, and even on my local machine, being a domain admin, I can not enable Windows Firewall. Even with the service started, the option in the menu is grayed out. – Jim March Jun 3 '09 at 18:46

I used PSTOOLS to do this recently. It lets you open up a cmd prompt to a remote machine. AFter that, just disable the firewall using

'netsh firewall set opmode mode = enable/disable'

share|improve this answer
Care to elaborate? I just showed the output from a test system in my initial response. IE: failure. – XTZ Jun 3 '09 at 19:07
sure....stand by...will have it in a few min – cop1152 Jun 3 '09 at 19:34
C:\pstools\psexec \\machine -u username -p password cmd Once connected type: netsh firewall set opmode mode = disable The output should just be 'ok' – cop1152 Jun 3 '09 at 19:38
That is if pstools is installed in the root of your C drive on your machine, not the target machine. – cop1152 Jun 3 '09 at 19:39
I just successfully tested it...worked fine – cop1152 Jun 3 '09 at 19:41

If the machines are set to PXE boot, you could set up an image with your tools of choice ready to go, perhaps something made from BartPE, and then just power cycle the building. =P

share|improve this answer
Too many unique machines, its a mind frick. – XTZ Jun 3 '09 at 19:09

Group Policy is able to handle this in a domain environment. You can also use the command netsh firewall set opmode mode = disable . Another way is through exporting the .reg key HKEY_LOCAL_MACHINE->SOFTWARE->Policies->Microsoft->WindowsFirewall & under the standard & domain profiles change "EnableFirewall" to 0. You can do it silently from cli by typing regedt /s filename.reg

share|improve this answer

While the users will have the local admin rights, you can't do anything that they won't be able to undo.

Don't your company have some "convention" on what can be done using the company's computers and what must not be done?

And as there's nothing dialog can't change, have you tried to discuss with the users and ask them to disable their firewall?

share|improve this answer
We do have an IT Policy, I guess it would be a good idea to add this to the list of Don'ts. Enforcement on the policy is rather lackluster however. – XTZ Jun 3 '09 at 18:58

Can you not punt this question to your boss for "training/advice on how to solve it"? The advantage of being junior is that you can always kick things upstairs when its a result of your supervisor's stupid ideas so they get to see the consequences of their decisions.

share|improve this answer
Maybe, i stopped caring about this company when my boss decided a virtual server needed 4gb ram for a Terminal server for 8 users... – XTZ Jun 3 '09 at 19:08
yeah, but RAM is cheap :) better to have too much than too little. – gbjbaanb Jun 21 '09 at 15:41

Two thoughts ...

1- Learn to use Group Policy. Not just for this task, but for your career. You can control settings and you can control access to make changes. The local admin can change the settings unless access is restricted, at which point domain admin trumps local admin (as Kara eloquently put it).

2- I suspect the firewall is blocking the incoming connections which you are trying to use to turn off the firewall. Put another way .. if the firewall is set to block incoming connections, you won't be able to connect to execute a command and disable it!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.