1

I am a Jr Admin of a company who's boss seems to think its a good idea to get local admin rights to all users... I can't win until i take his job. We have some users who set the firewalls to disable all connections coming in.

How can I remotely reconfigure these firewalls without their knowledge?

Failed attempts below!

S:>net use \192.168.1.71\IPC$ "password" /user:domain\username The command completed successfully.

S:\pstools>sc \192.168.1.71 pause "Windows Firewall/Internet Connection Sharing (ICS)" [SC] OpenSCManager FAILED 1722:

The RPC server is unavailable.

S:\pstools>telnet \192.168.1.71 135 Connecting To \192.168.1.71...Could not open connection to the host, on port 13 5: Connect failed

S:\pstools>psservice \192.168.1.71 -u domain\username -p password stop "Windows Firewall/Internet Connection Sharing (ICS)"

PsService v2.21 - Service information and configuration utility Copyright (C) 2001-2006 Mark Russinovich Sysinternals - www.sysinternals.com

Unable to access Service Control Manager on \192.168.1.71: The RPC server is unavailable.

Sure I could drive out grab the machine, do some things to get me fired to have things done correctly, but i'm looking for a simpler way to get this done.

Improve this question

8 Answers 8

Reset to default
7

Group Policy is the best answer for this. All of the firewall settings can be set and enforced through this method.

Improve this answer
3
  • Unfortunately most of these machines are remote, without DCs to connect to. The GPO would push to the machine, but they would have full access to edit the firewall settings after its said and done.
    – XTZ
    Jun 3, 2009 at 18:39
  • No, they won't. The group policy push for Firewall settings can be set to disable the users' ability to change those settings.
    – Kevin Kuphal
    Jun 3, 2009 at 18:57
  • Sounds like this is the best route then. Thanks guys.
    – XTZ
    Jun 3, 2009 at 19:27
5

Two words: Group Policy

Improve this answer
6
  • Group policy can't be overriden by a local admin?
    – Michael Todd
    Jun 3, 2009 at 18:38
  • It can, but not without some amount of magic.
    – u1686_grawity
    Jun 3, 2009 at 18:39
  • @Michael absolutely not. Domain admin trumps local admin.
    – Kara Marfia
    Jun 3, 2009 at 18:40
  • That's great to know!
    – Michael Todd
    Jun 3, 2009 at 18:43
  • With group policy you can completely grey out the ability for them to change the settings at all. We have Windows Firewall turned off via group policy, and even on my local machine, being a domain admin, I can not enable Windows Firewall. Even with the service started, the option in the menu is grayed out.
    – Jim March
    Jun 3, 2009 at 18:46
2

I used PSTOOLS to do this recently. It lets you open up a cmd prompt to a remote machine. AFter that, just disable the firewall using

'netsh firewall set opmode mode = enable/disable'

Improve this answer
5
  • Care to elaborate? I just showed the output from a test system in my initial response. IE: failure.
    – XTZ
    Jun 3, 2009 at 19:07
  • sure....stand by...will have it in a few min
    – cop1152
    Jun 3, 2009 at 19:34
  • C:\pstools\psexec \\machine -u username -p password cmd Once connected type: netsh firewall set opmode mode = disable The output should just be 'ok'
    – cop1152
    Jun 3, 2009 at 19:38
  • That is if pstools is installed in the root of your C drive on your machine, not the target machine.
    – cop1152
    Jun 3, 2009 at 19:39
  • I just successfully tested it...worked fine
    – cop1152
    Jun 3, 2009 at 19:41
1

If the machines are set to PXE boot, you could set up an image with your tools of choice ready to go, perhaps something made from BartPE, and then just power cycle the building. =P

Improve this answer
1
  • Too many unique machines, its a mind frick.
    – XTZ
    Jun 3, 2009 at 19:09
1

Group Policy is able to handle this in a domain environment. You can also use the command netsh firewall set opmode mode = disable . Another way is through exporting the .reg key HKEY_LOCAL_MACHINE->SOFTWARE->Policies->Microsoft->WindowsFirewall & under the standard & domain profiles change "EnableFirewall" to 0. You can do it silently from cli by typing regedt /s filename.reg

Improve this answer
1

While the users will have the local admin rights, you can't do anything that they won't be able to undo.

Don't your company have some "convention" on what can be done using the company's computers and what must not be done?

And as there's nothing dialog can't change, have you tried to discuss with the users and ask them to disable their firewall?

Improve this answer
1
  • We do have an IT Policy, I guess it would be a good idea to add this to the list of Don'ts. Enforcement on the policy is rather lackluster however.
    – XTZ
    Jun 3, 2009 at 18:58
1

Can you not punt this question to your boss for "training/advice on how to solve it"? The advantage of being junior is that you can always kick things upstairs when its a result of your supervisor's stupid ideas so they get to see the consequences of their decisions.

Improve this answer
2
  • Maybe, i stopped caring about this company when my boss decided a virtual server needed 4gb ram for a Terminal server for 8 users...
    – XTZ
    Jun 3, 2009 at 19:08
  • yeah, but RAM is cheap :) better to have too much than too little.
    – gbjbaanb
    Jun 21, 2009 at 15:41
0

Two thoughts ...

1- Learn to use Group Policy. Not just for this task, but for your career. You can control settings and you can control access to make changes. The local admin can change the settings unless access is restricted, at which point domain admin trumps local admin (as Kara eloquently put it).

2- I suspect the firewall is blocking the incoming connections which you are trying to use to turn off the firewall. Put another way .. if the firewall is set to block incoming connections, you won't be able to connect to execute a command and disable it!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .