Quick Windows 2000 Server Questions

OK.. I did something stupid. I remotely installed ZoneAlarm on a Windows 2000 server using PCAnywhere. I figured that even though I was connected remotely through PCAnywhere that ZoneAlarm would let me configure it before it locked everything up. I was wrong. ZoneAlarm locked down the internet connection and disconnected me from PCAnywhere. I can no longer PCANywhere into that computer, and the internet connection is locked down and the outside can no longer get in. Also have a mail server running on that machine, and I can't get my mail. And the DNS service has also been locked down from the outside world. So this kind of sucks.

However, I have PCAnywhere installed on another Windows 2000 server that is on the same network as that DNS server. I was able to use MMC to edit the services that are started on the server that is locked down. I disabled the two truevector zonealarm services. So theoretically if I can get the machine to restart then ZoneAlarm will not start with it. Hence, the outside world will no longer be locked out.

Does this technique sound like it will work, or are there any other things besides those 2 services that need to be disabled in order for ZoneAlarm not to automatically start when the computer boots?

Also how can I restart that server? It seems like ZoneAlarm didn't lock down the local network, so I can still access information using MMC from a computer on the same network. Since I am able to PCAnywhere into another computer on the network I am able to use MMC on the locked down computer through the local network. Is there anyway I can restart that server using a feature in MMC? I do have admin privledges.

I know... confusing. Sometimes I wonder how I get myself into these things. I can fix it later when I can actually get to the location of the computer, but I won't be able to get there until tonight. I want to try and pull this off remotely. Any ideas? This could get fun but painful. :(

Well if you have MMC access you should be able to stop the truevector services... No?

Ammo

Do you have Terminal Services installed on the locked down computer? If you do, you may be able to PCAnywhere into the other computer on the same network, TS into the locked down computer, and re-start it from there, or disable the firewall completely from inside the TS session.

Just a thought. Best of luck

Quote:

---

Well if you have MMC access you should be able to stop the truevector services... No?

---

I already did, but for some reason I am still locked out. You can't even ping the machine from outside the network. That's why I want to reboot it, to make sure that truevector isn't loaded at all, or any other components that may have been loaded by the services.

Quote:

---

Do you have Terminal Services installed on the locked down computer? If you do, you may be able to PCAnywhere into the other computer on the same network, TS into the locked down computer, and re-start it from there, or disable the firewall completely from inside the TS session.

---

I am not familiar with Terminal Services, but I did notice there is an entry for it in services. It is currently set to manual. If it comes down to it I guess I can start the service, and figure out how it all works.

But, I did find out that I can send run commands to the computer that is locked down through task scheduler using MMC. So I think if I can just find the run command to reboot the machine, without any confirmation screens of course, then the computer should restart with out ZoneAlarm on. That's what I am aiming for.

So anyone know the run command to reboot a Windows 2000 Server machine?

here's a link to a MS how-to using shutdown.exe
http://support.microsoft.com/default...;EN-US;q317371
if the link doesn't work search for q317371

My Win2K Servers don't have shutdown.exe installed. I think XP Pro does by default, so if you have local network access you should be able to send the remote shutdown with the right switches to close all progs and restart.

Hope it helps.

Set Op = GetObject("winmgmts:{impersonationLevel=impersonate,
(RemoteShutdown)}//server")
for each OpSys in Op
OpSys.Reboot()
Next

where //server= the name of the server to reboot hope this helps.

If you have DNS and Mail, you'd probably have ftp correct? Try using an ftp client to go in and remove the file itself. Im not sure of a good way to do it but your way sounds good as well. I think it will work.

try the reboot utility in the w2k reskit..

Ammo

Why would you do this anyway?

Put you firewall on a different system and use a managment station to work on it.
A firewall on the mail server is bad practice. IMHO Mail behind the fire wall with port and packet scanning is the way to go.

Can you explain a bit better Soumic? I assume the firewall may be installed upon the only system it can be installed on and it may also be the DC. The system is Admined from emote, and well maybe another box is not an option so them what can one do? Sometimes you work with what you have with the options you have is all.