Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a Windows 2012 R2 domain controller that doesn't need any Filter and Printer sharing ports open, so in an attempt to harden the server I've tried disabling the rules in the "File and Printer Sharing" group.

However, every time I reboot, the rules keep getting enabled. I've tried removing it everywhere, include the Windows Firewall "Allow features" settings as well on the NIC connection settings. But it keeps getting enabled when I reboot.

Short of writing a script to disable the rules and adding it to the scheduled tasks, how do I get the disabled rules to stay disabled?

Thanks.

Update: Sorry, I should have been clearer. I'm only using this server for running Exchange, no other clients will be connecting to the domain controller for authentication. I realize it's not a recommended configuration (running it on the domain controller), but it's only for a few users. It's sitting facing the internet, and I'd like to only allow port 25 and 443 (for owa and rpc over http).

share|improve this question
3  
I'm pretty sure that disabling File Sharing on a Domain Controller is going to render ADDS unusable. –  joeqwerty Oct 14 '13 at 23:17
    
@joeqwerty I'll vote for that. How are clients going to get Sysvol and Netlogon? –  Ryan Ries Oct 14 '13 at 23:37
    
@Ryan - exactly. :) –  joeqwerty Oct 14 '13 at 23:39

1 Answer 1

Blocking File and Printer Sharing will break Active Directory Domain Services. If you review the Active Directory and Active Directory Domain Services Port Requirements you'll notice that following ports need to be open. The reason the rules get re-enabled is when you install Roles that require certain services and their ports to be open Windows will automatically enable those rules.

  • UDP 137, File and Printer Sharing (NB-Datagram-In)
  • UDP 138, File and Printer Sharing (NB-Name-In)
  • TCP 139, File and Printer Sharing (NB-Session-In)
  • TCP 445, File and Printer Sharing (SMB-In)
share|improve this answer
    
Sorry, I should have been clearer. I'm only using this server for running Exchange, no other clients will be connecting to the domain controller for authentication. I realize it's not a recommended configuration (running it on the domain controller), but it's only for a few users. It's sitting facing the internet, and I'd like to only allow port 25 and 443 (for owa and rpc over http). –  Lambo Jayapalan Oct 15 '13 at 23:49
    
Wait - you are running Exchange on a Domain Controller that is internet facing? That sounds like a terrible idea for reasons too numerous to mention. Since you are using Server 2012, install Hyper-V and then install Exchange in one VM and your Domain Controller in the other. –  kce Oct 16 '13 at 1:08
    
Running two separate instances of Windows ties up quite a lot of resources in terms of RAM/disk space. I understand that it's not a recommended configuration, but based on my understanding it is a supported configuration. If every port is blocked except 443 and 25, then is it that bad? –  Lambo Jayapalan Oct 16 '13 at 3:02
    
Yes. It's a bad idea. Especially since there are other substantially better options available to you. If you want to proceed you will need another firewall between your upstream connection and your Exchange Server/Domain Controller because I can't think of way to prevent Windows from automatically enabling those rules. –  kce Oct 16 '13 at 16:24
    
What are the substantially better options, given I don't want to waste resources running 2 separate instances of Windows? –  Lambo Jayapalan Oct 17 '13 at 18:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.