6

After reading this article and this one I've decided to change all our firewalls to reject instead of block packets in most cases. My experience corroborates the arguments these articles make.

Unfortunately, Windows 2008 R2 uses the so-called "stealth mode" by default and I've found no obvious way to disable it correctly.

In comments below the Technet article, there is a link to the following msdn article that shows a key or struct of some sort that might disable it. But I was unable to find any key with "stealth" in the registry. Anyway, a second comment indicates this might not work anyway:

"Certain elements of the filtering platform are always active, even when the firewall is disabled, including Stealth Mode. There is no supported way to disable stealth mode."

So does "Stealth Mode" do anything other than reject packets? Does anyone know how to disable stealth mode?

7

In Windows 2008R2 or later, locate each of the following keys in the registry:

HKLM\Software\Policies\Microsoft\WindowsFirewall\DomainProfile
HKLM\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile
HKLM\Software\Policies\Microsoft\WindowsFirewall\PublicProfile
HKLM\Software\Policies\Microsoft\WindowsFirewall\StandardProfile

Add or edit the following value: DisableStealthMode (type REG_DWORD), and set it to 1.

References:

  • 1
    Could you add a reference any documentation concerning this method? – Wesley Feb 13 '12 at 2:55
  • @WesleyDavid My apologies, reference added – Mathias R. Jessen Feb 13 '12 at 3:02
  • 1
    Had to add WindowsFirewall and subkeys since they didn't exist yet. Otherwise, everything worked great. I tested in broser by trying to access the sever IP with a random port. Thanks so much! – labyrinth Feb 20 '12 at 0:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.