So here's a little background. Our system originally started with Windows Server 2003 machines and eventually over time expanded and grew. We still have a few Server 2003's but they're being removed. Our domain controllers were recently upgraded from Server 2003 to Server 2012 R2 this summer.
While attempting to manage a remoter computer from the MMC snap in for Active Directory Users and Computers, the server at times is unable to open Computer Management for the remote workstation.
Our PDC has the following roles/features installed:
- Active Directory Domain Services
- DNS Server
- DFS
- Group Policy Management
- Remote Server Administration Tools
Whenever an admin attempts to manage a workstation (in any OU), the following error is logged only on the server:
- DCOM got error "2147944122" from the computer workstation1.contoso.com when attempting to activate the server: {03837521-098B-11D8-9414-505054503030}
The following Firewall rules are enabled by Group Policy:
- Computer Configuration\Policies\Administrative Templates\Network\Network Connections\Windows Firewall\Domain Profile\Windows Firewall: Allow inbound remote administration exception
Beyond that, we do have several Spiceworks port exceptions enabled for TCP ports 135,445 and UDP 137.
All workstations are running Windows 7 Professional SP1 and are up-to-date as of December's Patch Tuesday. When the Firewall is disabled on any Windows 7 workstation machine, no error is logged and the Remote Management works fine. I'd also like to note we use Vipre Business Premium.
So here's my question:
Since I assume that it is a port that is being blocked by the workstation or remote machine, does anyone know which port(s) it is, or is there a better way to set this up via GPO so that all machines can be remotely managed?
I've attempted the following fixes without success:
- Port exceptions for WMI related services/executables
- Checking the Windows Firewall eventlog for blocked ports
- Used Wireshark to determine that it looks like Windows uses dynamic ports anywhere from tcp port 1024 on up including port 41975, and an exception with a range did no good.
Any help/suggestions is appreciated!