Firewall issues

simonfell1904 · 2009-09-03T06:20:32.000Z

Hi all,

I have been trying to get spioceworks to scan my pc’s for several weeks now.

So far I have

opened up TCP ports 135 and 445 and UDP 137

I have run the ‘netsh firewall set service remoteadmin enable’ command

and have run

winmgmt -standalonehost

net stop "windows management instrumentation’

net start "windows management instrumentation’

netsh firewall add portopening protocol=tcp port=24158 name=WMIFixedPort

instead of opening up 1024-2000.

Is there something i am missing, or do i still need to open up all of the ports, and if so, what is the easiest and quickest method.

Thanks for any help, but spiceworks looks like a fantastic tool but is starting to annoy me now.

Simon

rogerspainhower6169 · 2009-09-03T06:54:04.000Z

Disabling the Firewall Using Group Policy

This method is for IT administrators with administrative access to UT-managed machines that are part of a Windows 2000 or 2003 Active Directory domain.

Create a new Group Policy object, and give the object a descriptive name (for example, ITS-Turn off Windows Firewall).
Select the newly created group policy.
Right-click on the newly created policy and select Edit.
Expand the Computer Configuration folder, then the Administrative Templates folder.
Expand the Network folder, then the Network Connections folder, then the Windows Firewall folder.
Select the Standard Profile folder.
Double-click the Windows Firewall: Protect all network connections option.
Select Disabled, then click OK.
Select the Domain Profile folder.
Double-click the Windows Firewall: Protect all network connections option.
Select Disabled, then click OK.

simonfell1904 · 2009-09-03T07:14:21.000Z

Suppose i should have said, company policy states that I cant disable windows firewall, but I can change most settings within the firewall.

scottalanmiller · 2009-09-03T07:27:03.000Z

All I do is “netsh firewall set service remoteadmin enable” and that does it for me, obviously WMI and Remote Registry are running by default. I wonder if changing the WMI port could have an impact? Why did you feel the need to change it - the ports don’t open in a big blanket range the way that you opened them… they open dynamically only when in use.

simonfell1904 · 2009-09-04T01:00:11.000Z

I have read on the forums that all the ports need to be opened, or limit WMI to 1 port, limiting seemed an easier and safer option. btw If I disable the firewall service SW scans perfectly, making me believe that the problem is with the firewall.

scottalanmiller · 2009-09-04T06:49:41.000Z

That’s people talking about not using the “netsh firewall set service remoteadmin enable” command which handles all of that securely and dynamically. Some people don’t like to use that and so open the ports instead. The method that you are using opens them statically (and really having one port or many doesn’t matter too much if there are no services behind them) and opened them all of the time so is actually somewhat less secure.

I would set everything in the firewall back to normal and use the one command that is designed to allow exactly this access. There is a lot of extra firewall changes going on here that may be causing problems.