0

Here's one for you.

A while ago one of our big clients bought and partially rolled out an integrated connectivity package provided by a large UK mobile provider. The software includes a firewall (Proventia aka rebranded Black Ice Defender).

The software has finally been kicked back as not fit for purpose (doesn't work/too expensive). However we have around 75 laptops that it was installed on during the time we were 'using it' and now I want to remove it.

We can RDP to each machine and do it manually, but we're a small team and can't really afford the time to do so.

The problem is that the firewall software is blocking RPC access. I'm looking at pushing out a change to the firewall config on each machine (we have GPO's and logon scripts tha execute ok still) but its not very intuitive. In that I'm not sure its possible, I can't find any functional way of adding exceptions without manually hacking a .INI which I'll admit I don't really understand.

I've pulled the firewall installer apart and have got an 'agentremove.exe' which seems to work, but the problem is executing it remotely with enough rights to work.

PSEXEC and all the other tools we use for remote execution are blocked, we could launch the agentremove.exe from Startup scripts, but this wouldn't have enough rights, and putting plaintext admin user/pass in a startup script makes me shudder.

I'm looking at using GPO now, but I don't know enough about it to know if I can execute it on their machine with elevated rights.

Thoughts?

1 Answer 1

1

The easiest way I can see would be to make a computer startup script that removes it if it's present. There's no reason it shouldn't have enough privileges, since it runs at the System level. You may have been trying logon scripts, which run from the user's account.

This assumes your computers restart at any regular interval.

EDIT: If you need to elevate rights in a script, take a look at tokenized KiX scripts: http://www.kixtart.org

1
  • Thanks. Turns out that you can break the firewall by corrupting/deleting the .ini attached to it, which the user has permissions to do so I've just done that. Glad that we aren't actually using it now I've found that out. I'm going to look at Kix now though, looks useful.
    – Patrick
    Mar 25, 2011 at 14:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .