Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I updated my domain's default policy to add exceptions to the Windows Firewall, under

Administrative Templates < Network < Network Connection < Windows Firewall < Domain Profile

I changed Windows Firewall: Define program exceptions and added these 2 entries:

%system32%\lsass.exe:*:enabled:lsass
%system32%\svchost.exe:*:enabled:svchost

However when I run GPupdate /force from my client machine and run

netsh firewall show allowedprogram

I don't see either of these entries I added showing up on my exceptions. It's been probably half an hour since I updated the GP object so I assume it shouldn't be from just not waiting long enough to run gpupdate. Am I missing something? I've tried running rsop.msc but when I expand Administrative Templates in rsop it just stops responding after a while, or does it just take a while and I need to leave it alone?

Edit: After running GPupdate /force I get the event information "Security policy in the Group policy objects has been applied successfully."

After waiting longer with RSOP I can view the Administrative Templates, it shows my settings that allow remote administration exception and remote desktop exception is enabled. However I don't see any entries for them in the firewall when I run the netsh command. Also I am still getting security failures reporting the lsass and svchost are looking for connections so it's not that just working correctly and for some reason not displaying from the netsh command.

I cannot open \\domain\sysvol however I can open \\DomainControllerName\sysvol fine and see 1 node.

Edit:

Event Viewer Security Failure Audit

The Windows Firewall has detected an application listening for incoming traffic.

Name: - Path: C:\WINDOWS\system32\svchost.exe

C:\>netsh firewall show config

Domain profile configuration (current):
-------------------------------------------------------------------
Operational mode                  = Enable
Exception mode                    = Enable
Multicast/broadcast response mode = Enable
Notification mode                 = Enable

Service configuration for Domain profile:
Mode     Customized  Name
-------------------------------------------------------------------
Enable   No          Remote Desktop
Enable   No          Remote Administration

Allowed programs configuration for Domain profile:
Mode     Name / Program
-------------------------------------------------------------------
Enable   Network Diagnostics for Windows XP / C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
Enable   Remote Assistance / C:\WINDOWS\system32\sessmgr.exe
Enable   Windows Live Messenger / C:\Program Files\Windows Live\Messenger\msnmsgr.exe
Enable   Windows Live Sync / C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe
Enable   Adobe CSI CS4 / C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe
Enable   AOL Instant Messenger / C:\Program Files\AIM\aim.exe
Enable   Microsoft Office Outlook / C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
Enable   Microsoft Office Groove / C:\Program Files\Microsoft Office\Office12\GROOVE.EXE
Enable   Microsoft Office OneNote / C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE
Enable   spiceworks / C:\Program Files\Spiceworks\bin\spiceworks.exe
Enable   spiceworks-finder / C:\Program Files\Spiceworks\bin\spiceworks-finder.exe
Enable   Yahoo! Messenger / C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
Enable   Microsoft Visual Studio 2008 / C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\devenv.exe
Enable   firefox / C:\Program Files\Mozilla Firefox\firefox.exe

Port configuration for Domain profile:
Port   Protocol  Mode     Name
-------------------------------------------------------------------
5353   TCP       Enable   Adobe CSI CS4
3389   TCP       Enable   Remote Desktop

Standard profile configuration:
-------------------------------------------------------------------
Operational mode                  = Enable
Exception mode                    = Enable
Multicast/broadcast response mode = Enable
Notification mode                 = Enable

Service configuration for Standard profile:
Mode     Customized  Name
-------------------------------------------------------------------
Enable   No          Remote Desktop

Allowed programs configuration for Standard profile:
Mode     Name / Program
-------------------------------------------------------------------
Enable   Network Diagnostics for Windows XP / C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
Enable   Remote Assistance / C:\WINDOWS\system32\sessmgr.exe
Enable   Windows Live Messenger / C:\Program Files\Windows Live\Messenger\msnmsgr.exe
Enable   Windows Live Sync / C:\Program Files\Windows Live\Sync\WindowsLiveSync.exe

Port configuration for Standard profile:
Port   Protocol  Mode     Name
-------------------------------------------------------------------
3389   TCP       Enable   Remote Desktop

Log configuration:
-------------------------------------------------------------------
File location   = C:\WINDOWS\pfirewall.log
Max file size   = 4096 KB
Dropped packets = Disable
Connections     = Disable

Local Area Connection firewall configuration:
-------------------------------------------------------------------
Operational mode                  = Enable

Any one have any suggestions? This is causing my security log in the event viewer to fill up and on other workstations in my network that I have to manually clear the logs for regular users to be able to log into their system.

Edit 8/4/2009 - On further inspection it's actually not remote desktop/administration that's filling up my security log it's svchost loading dns cache: C:\WINDOWS\system32\svchost.exe -k NetworkService with the DLL c:\windows\system32\dnsrslvr.dll

I tried adding the dll itself to the allowed program list but that didn't seem to help and it doesn't let you add the svchost directly to the exception list.

Everything I find online points to this post: Event ID 861 Source Security which just isn't a solution since it involves svchost.

This post Event ID 861 Identify which services is running as a svchost is exactly the same situation I have, however it mentions the solution is to disable the dnsclient which obviously isn't an option in a domain environment.

According to Microsoft

Windows Firewall: dnscache

Updated: March 2, 2005

No Windows Firewall configuration is required to use this service.

If that's the case why is it still filling my event viewer. It seems like there has been alot of people affected by this issue filling their security logs whether it's specifically for dnscache or other services, everything I've been finding people just automatically want to say virus/malware etc and no one has offered a solution other than just disable audit tracking or disable the firewall service from running.

share|improve this question

3 Answers 3

up vote 1 down vote accepted
+100

I cannot open \domain\sysvol however I can open \DomainControllerName\sysvol fine and see 1 node.

This seems to support Evan's theory that you have more general problems with your AD. Can I suggest that you back off from the firewall specific job for a bit (just too many variables there) and try setting some other group policies, then seeing if they take? It won't resolve the specific problem you're having, but it will help in confirming if the theory is correct.

Can you also check that the File Replication Service and DFS Service are both running on all of your DCs? Also that each can resolve name-to-IP and IP-to-name for both themselves and all other DCs, that each has a correctly set FQDN and that each can resolve your domain name to your DCs IP addresses using nslookup.

Finally, you should use replmon to determine that your AD replication is healthy, and resolve any issues that throws up before proceeding with anything else.

share|improve this answer
    
DFS and File Replication Service are both started and automatic start up in services. –  Chris Marisic Aug 3 '09 at 17:45
    
FQDN isn't the issue I can look them up both ways to and from the server. –  Chris Marisic Aug 3 '09 at 17:47
    
Running replmon and searching for errors doesn't return any results. –  Chris Marisic Aug 3 '09 at 17:52
    
Do you have a recommendation on a setting I can change to test the replication on that is of trivial nature? –  Chris Marisic Aug 3 '09 at 17:53
    
Maybe try something in the Windows Media Player or Windows Movie Maker group? It may also be worthwhile restarting the FRS service and checking the ntfrs logs for any anomalies. –  Darth Satan Aug 3 '09 at 18:39

If you change this part of the policy:

Windows Firewall: Allow remote administration exception

that will automatically add lsass and svchost as exceptions.

share|improve this answer
    
I already had that enabled before I went to add the lsass and svchost exception and it didn't add those exceptions for me, it seems like it's just ignoring my policy >< –  Chris Marisic Jul 28 '09 at 16:12

It sounds to me like you're having a general group policy application problem. Typically, this is caused by:

  • Bad DNS settings on the client computer
  • Linking the GPO at the incorrect place to do what you're intending
  • Replication issues with the file portion of the GPO between domain controller computers

What are you seeing in the Application Event Log on the client computer after you attempt to force a policy refresh?

RSoP can take a short while to expand the "Administative Templates" node, but if it's never coming back then I suspect that your client computer is having difficulties accessing the domain SYSVOL. You could diagnose that by attempting to open \domain\sysvol in "Start / Run". You should see a single directory listed there with your domain's DNS name. If you get any errors then you probably have bad DNS settings on the client computer.

share|improve this answer
    
Added information in response to your questions –  Chris Marisic Jul 28 '09 at 17:04
    
Can you elaborate on these "Security Failures" that you're seeing (mentioned in your 2nd to last paragraph)? Can you also post the output of "netsh firewall show config" (sanitized as necessary)? –  Evan Anderson Jul 28 '09 at 19:18
    
I added the information you wanted, even though the remote admin/desktop area is enabled that was just from manipulation on my machine if I disable them and then apply GPUpdate /force they will not change back to on. Also I added entries to the program exception list on the policy for LSASS and SVCHost neither of which have been applied to my machine either. –  Chris Marisic Jul 29 '09 at 16:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.