Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am a Jr Admin of a company who's boss seems to think its a good idea to get local admin rights to all users... I can't win until i take his job. We have some users who set the firewalls to disable all connections coming in.

How can I remotely reconfigure these firewalls without their knowledge?

Failed attempts below!

S:>net use \192.168.1.71\IPC$ "password" /user:domain\username The command completed successfully.

S:\pstools>sc \192.168.1.71 pause "Windows Firewall/Internet Connection Sharing (ICS)" [SC] OpenSCManager FAILED 1722:

The RPC server is unavailable.

S:\pstools>telnet \192.168.1.71 135 Connecting To \192.168.1.71...Could not open connection to the host, on port 13 5: Connect failed

S:\pstools>psservice \192.168.1.71 -u domain\username -p password stop "Windows Firewall/Internet Connection Sharing (ICS)"

PsService v2.21 - Service information and configuration utility Copyright (C) 2001-2006 Mark Russinovich Sysinternals - www.sysinternals.com

Unable to access Service Control Manager on \192.168.1.71: The RPC server is unavailable.

Sure I could drive out grab the machine, do some things to get me fired to have things done correctly, but i'm looking for a simpler way to get this done.

share|improve this question
add comment

8 Answers 8

up vote 7 down vote accepted

Group Policy is the best answer for this. All of the firewall settings can be set and enforced through this method.

share|improve this answer
    
Unfortunately most of these machines are remote, without DCs to connect to. The GPO would push to the machine, but they would have full access to edit the firewall settings after its said and done. –  XTZ Jun 3 '09 at 18:39
    
No, they won't. The group policy push for Firewall settings can be set to disable the users' ability to change those settings. –  Kevin Kuphal Jun 3 '09 at 18:57
    
Sounds like this is the best route then. Thanks guys. –  XTZ Jun 3 '09 at 19:27
add comment

Two words: Group Policy

share|improve this answer
    
Group policy can't be overriden by a local admin? –  Michael Todd Jun 3 '09 at 18:38
    
It can, but not without some amount of magic. –  grawity Jun 3 '09 at 18:39
    
@Michael absolutely not. Domain admin trumps local admin. –  Kara Marfia Jun 3 '09 at 18:40
    
That's great to know! –  Michael Todd Jun 3 '09 at 18:43
    
With group policy you can completely grey out the ability for them to change the settings at all. We have Windows Firewall turned off via group policy, and even on my local machine, being a domain admin, I can not enable Windows Firewall. Even with the service started, the option in the menu is grayed out. –  Jim March Jun 3 '09 at 18:46
show 1 more comment

If the machines are set to PXE boot, you could set up an image with your tools of choice ready to go, perhaps something made from BartPE, and then just power cycle the building. =P

share|improve this answer
    
Too many unique machines, its a mind frick. –  XTZ Jun 3 '09 at 19:09
add comment

Group Policy is able to handle this in a domain environment. You can also use the command netsh firewall set opmode mode = disable . Another way is through exporting the .reg key HKEY_LOCAL_MACHINE->SOFTWARE->Policies->Microsoft->WindowsFirewall & under the standard & domain profiles change "EnableFirewall" to 0. You can do it silently from cli by typing regedt /s filename.reg

share|improve this answer
add comment

While the users will have the local admin rights, you can't do anything that they won't be able to undo.

Don't your company have some "convention" on what can be done using the company's computers and what must not be done?

And as there's nothing dialog can't change, have you tried to discuss with the users and ask them to disable their firewall?

share|improve this answer
    
We do have an IT Policy, I guess it would be a good idea to add this to the list of Don'ts. Enforcement on the policy is rather lackluster however. –  XTZ Jun 3 '09 at 18:58
add comment

Can you not punt this question to your boss for "training/advice on how to solve it"? The advantage of being junior is that you can always kick things upstairs when its a result of your supervisor's stupid ideas so they get to see the consequences of their decisions.

share|improve this answer
    
Maybe, i stopped caring about this company when my boss decided a virtual server needed 4gb ram for a Terminal server for 8 users... –  XTZ Jun 3 '09 at 19:08
    
yeah, but RAM is cheap :) better to have too much than too little. –  gbjbaanb Jun 21 '09 at 15:41
add comment

I used PSTOOLS to do this recently. It lets you open up a cmd prompt to a remote machine. AFter that, just disable the firewall using

'netsh firewall set opmode mode = enable/disable'

share|improve this answer
    
Care to elaborate? I just showed the output from a test system in my initial response. IE: failure. –  XTZ Jun 3 '09 at 19:07
    
sure....stand by...will have it in a few min –  cop1152 Jun 3 '09 at 19:34
    
C:\pstools\psexec \\machine -u username -p password cmd Once connected type: netsh firewall set opmode mode = disable The output should just be 'ok' –  cop1152 Jun 3 '09 at 19:38
    
That is if pstools is installed in the root of your C drive on your machine, not the target machine. –  cop1152 Jun 3 '09 at 19:39
    
I just successfully tested it...worked fine –  cop1152 Jun 3 '09 at 19:41
add comment

Two thoughts ...

1- Learn to use Group Policy. Not just for this task, but for your career. You can control settings and you can control access to make changes. The local admin can change the settings unless access is restricted, at which point domain admin trumps local admin (as Kara eloquently put it).

2- I suspect the firewall is blocking the incoming connections which you are trying to use to turn off the firewall. Put another way .. if the firewall is set to block incoming connections, you won't be able to connect to execute a command and disable it!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.