The root cause as others have identified is that IISReset requires RPC and by default in newer versions of Windows the required ports are blocked by default (which is a good thing).
You need to open up two sets of ports:
135/tcp - This is the port-mapper as others have mentioned. It negotiates a port in the
RPC Dynamic Port Range to communicate on
RPC Dynamic Port Range - This is a range of ports that is negotiated above that is used to perform the tasks. I was unable to find any documentation that is still active for this range. As @Ansgar Wiechers mentions this is a high port and changed in Windows Server 2008. I suspect that this change in behavior is why the documentation (https://support.microsoft.com/en-us/help/217351 Formally Microsoft KB217351 DCOM port range configuration problems) has been removed.
If you use Windows Firewall it provides a mnemonic to open the port range @Greg Bray's Answer is close to correct but it opens communication to inetinfo.exe which as far as I can tell was not needed.
The following works for us:
netsh advfirewall firewall add rule name="COM+ (DCOM-In) Port Mapper" dir=in action=allow description="Allow Communication to the DCOM Service Control Manager" enable=yes localport=135 protocol=tcp remoteip=x.x.x.x
netsh advfirewall firewall add rule name="COM+ (DCOM-In) Dynamic Port Range" dir=in action=allow description="Allow DCOM Communication" enable=yes localport=RPC protocol=tcp remoteip=x.x.x.x
I will explain each section of the above commands:
netsh advfirewall firewall add rule
- We are going to add a rule to the Windows Firewall
- Name of this rule; Customize as you see fit
- We are going to allow communication
- A Description; Customize as you see fit.
- We want to enable these rules
- In this first usage we are explicitly opening up a port number
- In this second command we set this to
RPC which tells Windows Firewall if it is in the Dynamic Port Range to allow it without having to specify each port individually
- All RPC calls use
TCP so we specify this as the protocol
- This is super important; it says that this firewall rule should only apply to the specified IP Address. While it is not required it is STRONGLY recommended that you specify this to narrowly define the Firewall rule.