How to control Windows XP SP2 Windows Firewall via Active Directory

  • Thread starter Thread starter noraschid.ghani
  • Start date Start date
N

noraschid.ghani

Hi,

I have AD implementation in my organization. We are divided between
the main hq and 37 remote sites. Recently we wanted to roll out SP2 to
all our workstations in the hq and remote sites. We have a checkpoint
firewall in between the hq and remote sites. For the workstations at
the hq, we are not experiencing any problem with managing the windows
firewall via OU/AD. We are able to manage the exceptions, greting out
the options etc. However it is the reverse for the remote sites
workstations. Is there a specific port to added in the firewall rules?
Thanks for any suggestion.
 
At what scope have you defined the GPO? Does the checkpoint allow ICMP
through? What speed connections are the WAN links?

--

Paul Williams

http://www.msresource.net/
http://forums.msresource.net/

Hi,

I have AD implementation in my organization. We are divided between
the main hq and 37 remote sites. Recently we wanted to roll out SP2 to
all our workstations in the hq and remote sites. We have a checkpoint
firewall in between the hq and remote sites. For the workstations at
the hq, we are not experiencing any problem with managing the windows
firewall via OU/AD. We are able to manage the exceptions, greting out
the options etc. However it is the reverse for the remote sites
workstations. Is there a specific port to added in the firewall rules?
Thanks for any suggestion.
 
Hi Paul,


Thanks for the reply. ICMP is permitted for connection from HQ to
remote sites. The WAN link is around 7Mbps to the ISP while from the
ISP to the remotes sites around 512Kbps.

About the scope, for the authenticated users, I have the permission to
allow read access.

Again many thanks for your help!
 
In addition to read access, authenticated users should also have apply GPO
permissions. This then encompasses everything within scope, i.e. computer
settings in an OU will apply to all computers in that OU.

The next thing to ensure is that you've configured this GPO so that it does
apply to the correct computers.

If this is the case, you should look in the event logs, specifically for
userenv and scecli errors and warnings. Cross reference these events with
www.eventid.net

If there's no joy there, we'll have to enable verbose logging and run some
more tests.

At what level of the AD hierarchy have you defined the GPO, and what
settings (computer or user) are you trying to apply?


--

Paul Williams

http://www.msresource.net/
http://forums.msresource.net/

Hi Paul,


Thanks for the reply. ICMP is permitted for connection from HQ to
remote sites. The WAN link is around 7Mbps to the ISP while from the
ISP to the remotes sites around 512Kbps.

About the scope, for the authenticated users, I have the permission to
allow read access.

Again many thanks for your help!
 
Back
Top