XP SP2 Firewall

Printable View

November 10th, 2005, 04:01 PM
unonthedl

XP SP2 Firewall

For Christ's sake, if you are running Windows XP SP2 in an enterprise environment turn off that pesky firewall now!!! :fpissed: I have a client with 140+ machines that wants to distribute clients to machines (for inventory - express metrix & websense net agents) via the server, but you can't with that damn firewall enabled...and yes you MUST have admin access to the local box which means I have to walk to every damn machine (yea I can use a script but someone still has to be there to login in to run it). Anyway...that is all...I'm done...

PS Thanks for creating a place for me to vent...I feel better...suggestions are welcome...
November 10th, 2005, 04:20 PM
Maverick811

LOL, I know what you are saying - that's one of the first services/applicatons that I shut down when setting up a new box on my network. All of the users on my network are behind my corporate firewall and I see no need for each client PC to be running Windows Firewall - I know some will disagree, but that's how it's done on my network....
November 10th, 2005, 04:28 PM
guardian alpha

I understand your pain. While the default firewall may be enough for general users it simply doesn't cut it when you get down to the integrity of your networks. Unfortunatally the only way you could disable the firewall in SP2 remotely is for a remote-desktop session, since they did not code in any sort of remote firewall management.

You may or may not already have a script to disable the firewall, but if not (and for the readers) here you go:

Code:

On Error Resume Next ' suppress errors Set objFirewall = CreateObject("HNetCfg.FwMgr") If Err.Number = 0 Then ' Object created ok, continue with disabling the FW Set objPolicy = objFirewall.LocalPolicy.CurrentProfile objPolicy.FirewallEnabled = False End If On Error Goto 0

Plug that into a file such as firewall.vbs and save it. Give it a run :)

This will completely disable the firewall for XP SP2 without the continual configuration menus you would normally have to go through. Email it to yourself or even slap it on a floppy/usb drive for speed rather than rewrite it each time.
November 10th, 2005, 05:50 PM
unonthedl

Alpha: thanks for the script, but yes, I do already have it and it's part of my logon script so all I have to do is log on to each machine and then remove that portion of the logon script when I am done with all the machines.
November 10th, 2005, 07:00 PM
Falcis

uhhh?

Just curious why you would not want to go ahead and make that a part of the general login script rather than going from machine to machine. Did I miss why that won't work?

Falcis
November 10th, 2005, 07:04 PM
unonthedl

The people who logon to the machines are not part of the admin group meaning they don't have admin privlages meaning the script would fail. You must be an admin to disable the firewall, therefore I must walk to all machines and run the script myself.
November 10th, 2005, 07:08 PM
warl0ck7

Download psexec from www.sysinternals.com

put your machine ips in a file say file.txt

c:\>for /f %i in (file.txt) do psexec \\%i -u administrator -p <password here> sc stop SharedAccess

this should stop the firewall, if you wish to disable it compeletly

try sc delete SharedAccess
November 10th, 2005, 07:35 PM
unonthedl

Quote:

Download psexec from www.sysinternals.com

put your machine ips in a file say file.txt

c:\>for /f %i in (file.txt) do psexec \\%i -u administrator -p <password here> sc stop SharedAccess

this should stop the firewall, if you wish to disable it compeletly

try sc delete SharedAccess

So I tried this and got an error "ip.txt (my file name) was unexpected at this time"

So then I tried c:\>psexec -i @ip.txt -u administrator -p <password> sc stop (also tried delete) SharedAccess

and got this...

Code:

PsExec v1.63 - Execute processes remotely Copyright (C) 2001-2005 Mark Russinovich Sysinternals - www.sysinternals.com \\10.0.1.74: Couldn't access 10.0.1.74: The network path was not found.

I'm guessing this didn't work because the firewall wasn't disabled so I couldn't access the machine remotly.

HELP! :D
November 10th, 2005, 07:45 PM
slarty

One difficulty with this is if you have laptop users, particularly if they have WLAN cards, then they may take their machines out to various other sites.

There having the firewall disabled is much less of a good idea.

Then they'll bring all sorts of nasties back in with them when they return. I wonder if there's a recipe which can make it turn off only when logged on to your nice safe lan?

Slarty
November 10th, 2005, 07:58 PM
!mitationRust

Quote:

Originally posted here by slarty
I wonder if there's a recipe which can make it turn off only when logged on to your nice safe lan?

Slarty

I'm on it right now, thumbing through Tim hill's NT shell scripting book. I know some people that can make some very robust hardcore batch scripts. Since the firewall is a NT native .exe it shouldn't be that difficult. I'll be back with something.
November 10th, 2005, 08:33 PM
unonthedl

Quote:

One difficulty with this is if you have laptop users, particularly if they have WLAN cards, then they may take their machines out to various other sites.

There having the firewall disabled is much less of a good idea.

Then they'll bring all sorts of nasties back in with them when they return. I wonder if there's a recipe which can make it turn off only when logged on to your nice safe lan?

Slarty

Fortunatly we don't have "take home" laptops (except for mine...but my firewall/router at home is configured quite well)

Quote:

I'm on it right now, thumbing through Tim hill's NT shell scripting book. I know some people that can make some very robust hardcore batch scripts. Since the firewall is a NT native .exe it shouldn't be that difficult. I'll be back with something.

I'm really looking forward to your response...
November 11th, 2005, 04:19 AM
!mitationRust

Re: XP SP2 Firewall

Quote:

Originally posted here by unonthedl
and yes you MUST have admin access to the local box which means I have to walk to every damn machine (yea I can use a script but someone still has to be there to login in to run it). Anyway...that is all...I'm done...

PS Thanks for creating a place for me to vent...I feel better...suggestions are welcome...

Suggestion, rather a question. Can't you just use netsh commands? -- remotely

Before I attempt this bombastic script ........... I wanna try this one....

Regulators......We regulate any stealing of his property and we damn good too.... But you
can't be any geek off the street, gotta be handy with the keys if you know what I mean, earn your keep.
November 11th, 2005, 04:55 AM
unonthedl

Quote:

Suggestion, rather a question. Can't you just use netsh commands? -- remotely

I haven't tried this...but I don't think I can do anything remotely (outside of RDP - which is only active on our servers) with the firewall active.
November 11th, 2005, 06:09 AM
!mitationRust

Code:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall \DomainProfile \EnableFirewall=0 (DWORD data type) HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall \StandardProfile \EnableFirewall=0 (DWORD data type)

EDIT*********************

I just read the whole post.

Here is what you need I believe.

Deploying Windows Firewall Settings Without Group Policy
November 11th, 2005, 09:05 AM
catch

I am not an admin, so I might be way off here... but it seems like configuring the laptop locally to have the firewall enabled and then to have it inhierit disabling the firewall for the local domain policy would work.

The firewall is on when it is part of an untrusted network and off when in the office.

cheers,

catch
November 11th, 2005, 02:30 PM
unonthedl

Quote:

Only local administrators can successfully execute scripts or custom configuration programs from an email message, a file share, or a Web page.

Again, still have to be an admin.

Quote:

One solution to this possible problem is to create the registry settings on your client computers to disable Windows Firewall before your users have a chance to install Windows XP SP2 from Windows Update. ICF on computers running Windows XP with SP1 and Windows XP with no service packs installed ignores these registry settings. When the user installs Windows XP SP2 from Windows Update and restarts their computer, Windows Firewall reads the registry settings already in place and disables itself.

So I have to re-install SP2? All the PCs are already running SP2...will this still work?

Quote:

To add a registry setting on all of your computers running Windows XP, you can use the Regini.exe or Reg.exe tools. For either tool, you create a script file that is read by the tool to add a registry setting. The tool has to be run in the security context of a local administrator account.

Do these programs need to be installed on all PCs? Again I still have to "touch" each PC.

I really hate putting in cases to Microsoft Support...but I might have to because this has been bothering me for some time.
November 11th, 2005, 03:59 PM
dinowuff

Can you run

netsh firewall show config

without admin rights?
November 11th, 2005, 06:41 PM
unonthedl

Quote:

Can you run

netsh firewall show config

without admin rights?

Yes

Code:

Microsoft Windows XP [Version 5.1.2600] (C) Copyright 1985-2001 Microsoft Corp. K:\>netsh firewall show config Domain profile configuration (current): ------------------------------------------------------------------- Operational mode = Enable Exception mode = Enable Multicast/broadcast response mode = Enable Notification mode = Enable Allowed programs configuration for Domain profile: Mode Name / Program ------------------------------------------------------------------- Enable Remote Assistance / C:\WINNT\system32\sessmgr.exe Standard profile configuration: ------------------------------------------------------------------- Operational mode = Enable Exception mode = Enable Multicast/broadcast response mode = Enable Notification mode = Enable Allowed programs configuration for Standard profile: Mode Name / Program ------------------------------------------------------------------- Enable Remote Assistance / C:\WINNT\system32\sessmgr.exe Enable RealPlayer / C:\Program Files\Real\RealOne Player\realplay.exe Log configuration: ------------------------------------------------------------------- File location = C:\WINNT\pfirewall.log Max file size = 4096 KB Dropped packets = Disable Connections = Disable Local Area Connection firewall configuration: ------------------------------------------------------------------- Operational mode = Enable Access is denied. K:\>
November 11th, 2005, 07:09 PM
guardian alpha

And that is viewable without admin rights? Sheesh, talk about an information security breech.
November 11th, 2005, 07:30 PM
dinowuff

I'm pretty sure you can use netsh firewall to reset the firewall settings and then disable. I know If done it in the past but can't remember how exactly but I know I was not admin on the remote box.

netsh /? see if any thing there will help. I have a feeling firewall dump and what not may give you a access denied error.
November 11th, 2005, 09:07 PM
shals

hii
tell me something about XP SP2 enterprise edition, ihave one version but how to check that it is enerprise or not
November 11th, 2005, 09:48 PM
dinowuff

Right click my computer (either on desktop or on the start menu)

choose properties

Read
November 11th, 2005, 10:21 PM
Maestr0

Just use the domain profile in group policy, ding-dongs. (Basically what catch was saying) The domain profile is active when the machine is in contact with the domain, otherwise the local profile is used. Someone already posted the reg keys.

-Maestr0
November 12th, 2005, 11:00 PM
Neptune0z

Alright, no one flame me here...Im not a big M$ fan, by any means...However, their ICF firewall really is a decent product, and perfectly suited to home users and can be a great compliment to "host based" defences inside a LAN. The only major drawbacks, are that it doesnt filter outbound connections, and doesnt do a very good job logging.

As far as concerns disabling the firewall over the network, and those of you that say it must be done locally on each machine or by script...What about NETSH?

Just install an SSH Shell (OpenSSH for Windows)
Log in
Issue the command NETSH SET OPMODE DISABLE (I believe)
November 13th, 2005, 02:37 AM
SouthernWolf

What you need is group policy

http://www.microsoft.com/downloads/d...n#requirements
November 14th, 2005, 02:26 PM
unonthedl

Thank you to everyone who responded...

Quote:

Just use the domain profile in group policy, ding-dongs. (Basically what catch was saying) The domain profile is active when the machine is in contact with the domain, otherwise the local profile is used. Someone already posted the reg keys.

I was able to turn the Firewall off in the Domain Policy in the Group Policy Management Console. Thanks again.
November 14th, 2005, 03:15 PM
!mitationRust

May I ask you a question? In your environment, who creates the overall policies? Do the admins create the policies or just merely enforce them?
November 14th, 2005, 04:31 PM
unonthedl

Quote:

May I ask you a question? In your environment, who creates the overall policies? Do the admins create the policies or just merely enforce them?

Our environment is a unique one. I work in a private k-8 school that is also a part of a Congregation. There are three members of the IT Staff (IT director, IT manager, Sys. Admin/Net. Admin - that's me). The IT director is responsible for merging technology into the curriculum and is not as technically savvy as myself and the IT manager. The IT manager has worked here for 20 some years and knows the environment very well (although is very technically savvy his education is Accounting and his experience mostly Novell (server/authentication). I've been working here about 3 years and have a wider range of technical knowledge (bachelors in Business Info Systems - minor in econ - with experience in coding/win and Linux network environments..etc....finishing masters in Advanced info systems. To get to the point… since we have such a mix of knowledge and experience (and responsibilities) we collectively make decisions and usually I (or the IT Manager) implement them.

Hope that answers you question...sorry for the rambling...