Remote assistance through GPO

[teqmod]

I am working to set up Remote assistance in our network. I have used this feature but walking a user through sending the invite can be more frustrating that actually working to fix the machine. If I disable the MS firewall it works. I have made the recommended modifications to the MS firewall as outlined:

If you use Windows Firewall, you would also have to add the following exceptions to the Windows Firewall local or group policy settings to make unsolicited remote assistance work.

Add the following entry to the Windows Firewall Port exceptions:

TCP port 135

Add the following entries to the Windows Firewall Program exceptions:

%WINDIR%\SYSTEM32\Sessmgr.exe
%WINDIR%\PCHealth\HelpCtr\Binaries\Helpsvc.exe
%WINDIR%\PCHealth\HelpCtr\Binaries\Helpctr.exe


With the firewall enabled and those settings applied no success. I am able to telnet to the machine on both port 135 and 3389. Does anyone have any ideas on what I may be migging here?

 

[teqmod]

Nevermind, I found the solution. Use the settings outlined in

http://support.microsoft.com/default.aspx?scid=kb;en-us;555179

and it works properly.

 

[58sniper]

If you have internal users with the firewall turned on, yet have an enterprise firewall separating you from the Internet, why not use a GPO to just turn off the XP firewall alltogether? Having the XP firewall turned on causes other issues as well, including those with Symantec AV client updates.

Pat Richard, MCSE(2) MCSA:Messaging, CNA(2)

 

[porkchopexpress]

I disagree I would recommend you keep using the XP firewall if possible, when configured correctly you can get all of your apps to work including AV updates and remote assistance (as you discovered).
Perimeter firewalls are no use at all when someone brings an infected laptop in and plugs it into your network as hundreds of companies have discovered over the last couple of years, the extra effort to configure this security feature could save you a massive headache in the future.

This is purely my opinion.

 

[porkchopexpress]

teqmod you could also use Gencontrol in certain situations, it's based on tight VNC and will work with the XP firewall if you have the allow file and printer sharing exception set. It installs at the start of a session and then unistalls when finished it's also free.

http://www.gensortium.com/products/gencontrol.html

 

[58sniper]

porkchopexpress -

I would have to disagree. If someone has an email bourne virus, it's going to get past the XP firewalls, since those are set to let email traffic through. File server AV, Exchange AV, and workstation AV will all capture that (if properly maintained). Enterprise antispyware solutions will also capture items. Having the XP firewall enabled is too constricting for administration purposes.

Pat Richard, MCSE(2) MCSA:Messaging, CNA(2)

 

[porkchopexpress]

Well of course you can still contract an email virus and so on but you will be more protected against zero day exploit worms that could take out every PC on your LAN before your kettle has finished boiling.

 

[porkchopexpress]

I can't see how it's so restrictive the XP firewall can be well managed with GP i use it on several LAN's with absolutly no problems.