How to disable XP Firewall remotely?

[ajrey]

Hello all!
I have a problem with XP Pro SP2. It installed the firewall and I use VNC to access those network PC's. And wont let me even use psexec to activate Remote Desktop Connection. I can't give the user the Local Administrator password to disable the Firewall manually. I'm running under Windows 2000 Server and all my network PC's are running under XP Pro.

I know there is a way tio deactivate it remotely but can't find the right command line.

Does anyone knows how to do this?

Thnx all!

 

[LloydSev]

If Microsoft added the ability to disable the firewall remotely, that would completely undermine the entire firewall and give absolutely no protection to users then.

I think you need to physically sit down at the machine, and next time remember to add a line in the exceptions list for VNC.

Computer/Network Technician
CCNA

 

[clayton74]

We run a script on boot that will disable the firewall and security centre with the following registry edits. Maybe this will help

Security Center Override

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc','Start','00000004','REG_DWORD'

Firewall Override
'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center','FirewallOverride','00000001','REG_DWORD')

Disable Firewall
'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile','EnableFirewall','0','REG_DWORD')

 

[bcastner]

You really do not want to disable the firewall.
You want to enable the ports required for VNC.

There is a huge difference.

 

[linney]

How to configure a connection to a virtual private network (VPN) in Windows XP

http://support.microsoft.com/default.aspx?scid=kb;en-us;314076&FR=1&PA=1&SD=HSCH

 

[BrentTh]

you can disable it thru a group security policy on an OU or the domain

 

[elmurado]

You can enable ports through GPO ComputerConfig>Admin templates>Network>Firewall.
Add VNC ports to the settings: "Define Port settings"
enable this and then hit show and add the ports that VNC needs to have open. In this format port:transport:scope:status:name
eg for port 2256 using udp for local subnet and enabled which you want to call VNC:
2256:UDP:localsubnet:enabled:VNC
Link GPO to OU that machine is in.
then do a gpupdate on target machine. Or get user to shutdown/restart.
Found this in google for VNC ports but have not tested...
5900 - Must be open on the Server
5800 - can be opened for Java (but 5900 has to be open too)
5500 - can be opened if you run listening viewers.
I'm guessing that it's tcp but could be wrong if it's both.

 

[bcastner]

Microsoft recommends using Netsh.exe
It is certainly a little tricky, but under XP SP2 will open any firewall ports required, including remotely:

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/netsh_int_ip.mspx

I warn you this tool is a little tough to get right in the syntax required.

 

[elmurado]

Just a thought but don't you need to have initiated an RDp first to be able to run netsh on a remote? Or is that only on W2000?

 

[bcastner]

....but don't you need to have initiated an RDp first to be able to run netsh on a remote"

No.

 

[elmurado]

This from the link above:
"..To run these Netsh commands on a remote Windows 2000 Server, you must first use Remote Desktop Connection to connect to a Windows 2000 Server that is running Terminal Server"

Or have I understood this wrong? I'm getting confused....must be Friday...

 

[bcastner]

Using Netsh

Netsh is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh also provides a scripting feature that allows you to run a group of commands in batch mode against a specified computer. Netsh can also save a configuration script in a text file for archival purposes or to help you configure other servers.

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/netsh.mspx

 

[bcastner]

I note too that I have little need of disabling the XP SP2 firewall on remote Win2k servers.

 

[bcastner]

Note: this is my bad an not Forum member elmurado's. I should earlier have provided a better link to the netsh.exe documentation.

 

[elmurado]

Thanks Bill--sorry if I confused everyone there--got so far into the post I forgot what the original post was about!

 

[bcastner]

elmurado,

No problem. You did have me scratching my head for a second as to the issue.

By the way, the Netsh.exe interface under XP SP2 is substantially broadened from its original apearance. As an MS-MVP I am fighting for a new and better and broader set of GUI-based tools for Windows Longhorn. I do not want to lose the command line tools, but I think if I have to type one more time to help an end user: "ipconfig /all" I want to scream. I also want folded into a GUI tool stack repair services such as a Winsock and TCP/IP repair.

Microsoft really does listen, so I will ask one more time: under Longhorn a GUI tool that performs the ten most used features of ipconfig and netsh.exe.

Best regards,
Bill Castner

 

[elmurado]

I always love playing with command line stuff but know that when it comes to assisting end user who is on the end of a phone line rather than a remote connection, trying to make sure syntax/spelling is correct is a nightmare.
Me: "Now type in I-P-C-O-N-F-I-G slash etc:
Them: "I PEE? Why do I do that? etc, etc

 

[bcastner]

I feel the pain.