Our team runs the following commands to turn on and off Windows Services (e.g. JBoss Native) from the Windows command line as well as through source code in a program. It connects to a remote box. We are now placing this box (\DEV-A1) into our DMZ. How can we still run this command remotely but use a secure port?

sc \\DEV-A1 stop JBAS50SVC
sc \\DEV-A1 start JBAS50SVC

sc.exe uses RPC to connect to remote hosts; RPC calls always start with a control connection to TCP port 135, but then another connection is opened using a random dynamic port to carry out the actual RPC call; the range of these dynamic ports can be limited, but how many of them are needed depends heavily on what the computer is doing.

Also, keep in mind that if the server is a domain member (which it probably is, since you are controlling it remotely with a command that uses integrated authentication), you will anyway need to open lots of ports in your firewall(s) in order for it to operate properly.

  • Looks like TCP protocol is secure! Thanks Massimo! – MacGyver Aug 13 '15 at 22:41
  • ........what?!? – Massimo Aug 13 '15 at 22:48
  • What was your question? – MacGyver Aug 13 '15 at 23:03
  • "Looks like TCP protocol is secure" means... what, exactly? – Massimo Aug 13 '15 at 23:08
  • Well, at first, our security department was saying if it was not secure, they wouldn't allow it, because it's in the DMZ. I am not sure how to tell if the protocols themselves are secure/encrypted, or if the individual ports are. Also, they had never heard of sc.exe before to turn on/off Windows Services. They were more familiar with PowerShell. – MacGyver Aug 13 '15 at 23:31

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.