How to remotely disable windows firewall

[astaylor]

I am looking for a way to remotely disable the windows firewall and not using group policy or startup scripts. I would like to be able to do it from the command line. Does anyone know the best way to do this? Maybe pstools? i am not that familiar with how to use it though.


-drew

 

[thefourthwall]

Did you try a Google search ??

 

[HalComps]

is this what your after?

http://www.utexas.edu/its/windows/resources/disable-wfw.html

 

[astaylor]

fourthwall - yes i did and if you will notice, most of the search results return solutions via group policy, startup scripts, and batch files. I would like to know if there is a way to disable through the command prompt.

halcomps - thanks for the link but 2 of the 3 ways require physical access and the other is group policy.


-drew

 

[IllogicallyLogical]

Maybe this will point you in the direction you are looking? Look into the netsh -r command to remotely configure a machine.

- Turn Windows Firewall On or Off for a Specific Connection (look towards the bottom for using the command prompt)

http://technet2.microsoft.com/windo...686a-449d-b681-daf25c9a18e81033.mspx?mfr=true

- Using Netsh

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/netsh.mspx?mfr=true

Joey
A+, Network+, MCP, Wireless#

 

[astaylor]

great idea joey. The problem that i run into though is that netsh is blocked by the firewall on the remote pc. any thing you can think of to get around this or another method?


-drew

 

[vacunita]

This is bordering on an hacking into a PC, and i don't think the mods will appreciate someone advising on how to break the firewall security of a PC.

Firewalls are designed to prevent such intrusions, can you explain why you are trying to do this, before a mod thinks its for something illegal and deletes this thread?

----------------------------------
Ignorance is not necessarily Bliss, case in point:
Unknown has caused an Unknown Error on Unknown and must be shutdown to prevent damage to Unknown.

 

[astaylor]

I see your point vacunita.

Here's the story. I sys admin for a company of about 150 users all using xp. About half of the computers have the firewall already disabled. The problem is this company is used to doing things the old fashion way (physically accessing every machine when something needs to be done). I am trying to automate things a little bit so that i dont have to do as much leg work. Right now i am working on deploying out the latest version of symantec antivirus. The problem is all pcs with the firewall turned on do not show up in the available computers list within the console. My other problem is (and this goes back to "the old fashion" way of things here) the CIO will not let me touch the AD to edit a group policy or assign a startup script to do this. Both of which would work perfectly. She is scared that something will go wrong and our systems will not work. I am trying to come up with an alternative way to turning the firewall off that does not envolve using the servers or me walking to 75 computers to do it. I know which computers they are but i would have to go to every machine, log each user out (because their desktops are locked down), log in as myself, and then disable manually.

So, i am not trying to hack anything, I do realize it borderlines that, but i really would like any help that i can get to make this easy on me as i would like to update our symantec client through the console and not manually on each machine.


-drew

 

[IllogicallyLogical]

great idea joey. The problem that i run into though is that netsh is blocked by the firewall on the remote pc. any thing you can think of to get around this or another method?

I was thinking the same thing shortly after I posted that, I guess I was having a brain fart. After all, what good would a firewall be if you could just remotely disable whoevers you want with a command. Hackers would be having a hayday. Anyways do the firewalls have an exception for Remote Connections? If so just remote in and disable. Other than that I would talk to your CIO about what a hassle it would be to manually do this and con her in to letting you use a group policy. Many companies enable the group policy to disable Windows Firewall because their computers are generally behind a more sophisticated hardware firewall.

Joey
A+, Network+, MCP, Wireless#

 

[astaylor]

Man i really wish i could! It would make life so much easier, but i can tell you it's out of the question. I could remote desktop into their computer but it would lock out their session till i was done, would be nice for them to be able to continue working plus i really don't want to have to call all of them to explain myself.

i wish their was a way to do the netsh command or something like it and provide administrative credentials to override.

any other ideas? or am i sol?


-drew

 

[linney]

Distributing Registry Changes

Q310516 HOW TO: Distribute Registry Changes to Computers in Windows XP

http://support.microsoft.com/support/kb/articles/q310/5/16.asp

You receive an "Access denied" or "The network path was not found" error message when you try to remotely manage a computer that is running Windows XP Service Pack 2

http://support.microsoft.com/default.aspx?kbid=840634&product=windowsxpsp2#appliesto

 

[astaylor]

Well i have tried that but i can't connect to the registry remotely because of the firewall. I do get the error in the second link, but it requires physical access to the computer for those fixes. I have tried the netsh command but of course because of the firewall it is blocked and i cant use group policy.


-drew

 

[cdogg]

Drew,
The registry keys you want to modify are:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall
\DomainProfile \EnableFirewall=0

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall
\StandardProfile \EnableFirewall=0


In your situation, it would probably be best to follow the advice in Linney's first link to e-mail each user a .REG file to import that makes the above changes. Of course, that makes the assumption that every user has admin rights. By default, the firewall only lets in connections initiated by Remote Assistance, so I don't think you're going to find any quick tips to get around it. You would need a hacker's tool to exploit running services to find a backdoor, but I don't think your CIO would want you doing that!

For future reference when building/reimaging computers, this article from Technet talks about using the Unattend.txt, as well as discussing some of the options already mentioned in this thread:

http://technet.microsoft.com/en-us/library/bb490624.aspx

~cdogg
"Insanity: doing the same thing over and over again and expecting different results." - Einstein
[tab][navy]For posting policies, click [/navy]here.

 

[astaylor]

Thank you cdogg. That is some good information. It definitely would not be wise to run any sort of hacking tool. I would be in more trouble than if i just went ahead and used group policy to do it the way i wanted to originally.


-drew