I am trying to configure endpoint machines with a firewall that only allows white-listed traffic, and all other connections are blocked.

The client machines are desktops and laptops running Windows 7 (both x86 and x64) using the built-in Windows Firewall with Advanced Security. Every machine is part of a Windows Server 2008 domain, and I am configuring the firewall using Group Policy. I am testing this firewall configuration with a small subset of machines.

Right now, I have Windows Firewall configured to block all inbound and outbound traffic that doesn't match an explicit allow rule. Here are the basic communications that are currently enabled:

  • DNS (UDP 53 Out)
  • LDAP (TCP 389 Out, UDP 389 Out)
  • Remote Desktop (TCP 3389 Out)
  • Web Browsing (TCP 80 Out)
  • Preset: Core Networking
  • Preset: Distributed Transaction Coordinator
  • Preset: File and Printer Sharing
  • Preset: Network Discovery
  • Preset: Remote Assistance

In addition, I have a few rules defined for the business applications we use. This has been working fairly well, but today I encountered some problems with MSRPC (Microsoft Remote Procedure Call).

I open mmc.exe and load the computer management snap-in in order to modify the local administrators group. In the "Select Users, Computers..." window I enter the username, then click "Check Names". It gives me the following error:

Windows cannot process the object with the name "Foo Bar" because of the following error:

Access is denied.

When I remove the firewall restrictions, it works fine. The traffic being blocked is MSRPC, and it uses a randomly selected port in the range of [49100...65535].

How can I create a rule for Windows Firewall that allows MSRPC traffic without creating an overly broad rule, such as allowing TCP traffic on all ports?


KB154596 "How to configure RPC dynamic port allocation to work with firewalls"

In short, it looks like you're going to be deploying a lot of registry changes via a GPO. Make sure to document all that you do and why you've done it. If anyone else has to curate the systems there, it will be quite a shock to see something as basic as RPC hardwired to certain ports. Not that it's bad, mind you. Just different.


I created a Windows Firewall rule that allows all TCP traffic for %SystemRoot%\System32\mmc.exe and that completely solved the problem.

In addition, I noticed two other programs that also need to have all TCP traffic allowed:

  • %SystemRoot%\System32\spoolsv.exe
  • %ProgramFiles%\Hyper-V\vmconnect.exe

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.