Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have been instructed to implement a Microsoft Groove workspace. This would normally not be a concern, but the workspace will be utilized by machines which exist in our internal/restricted network as well as from peers from an outside/unknown network.

Does there exist a best-practice for such an implementation?... or would this potentially expose the restricted network too broadly?

share|improve this question
up vote 1 down vote accepted

Groove seems designed around the idea that some clients may be behind firewalls and it has the ability to route around it's usual data channel TCP 2492 and use web ports (TCP 80 or 443). If your secure network allows these ports outbound (and even if it doesn't) the clients will probably be able to get a session going. If not, MS has a Groove Relay server product that can probably help facilitate communication if you're internal network is more restrictive.

The most useful documentation is probably here:

That being said, if you're allowing groove access between clients in a highly secure network and a low security network you are opening that secured network up to more risk. I don't know your business, so I can only guess at some of new risks:

  • Increased chance of malicious software being transfered in from a low security Groove Client to a high security client
  • Increasedhance of sensitive data being accidentally or intentionally transferred to the low security zone
  • Accidentally exposing vulnerable ports when opening firewall access
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.