#150625 - 2005-10-26 09:38 PM
Re: WindowsXP SP2 Firewall Question
|
NTDOC
Administrator
Registered: 2000-07-28
Posts: 11634
Loc: Space
|
HKLM = ALL USERS on the System typically unless the software has been written specifically to allow the HKCU to take precedence.
Read_Modify_XPFirewall() - Reads or Modifies XP firewall settings
http://www.kixtart.org/ubbthreads/showflat.php?Cat=0&Number=135843
|
|
Top
|
|
|
|
|
#150627 - 2005-10-26 11:00 PM
Re: WindowsXP SP2 Firewall Question
|
NTDOC
Administrator
Registered: 2000-07-28
Posts: 11634
Loc: Space
|
Quote:
Via GPO you can control this better
Yes, and that's what the UDF says as well 
Quote:
This UDF is mainly for those who are unable to use GPO (preferred method).
|
|
Top
|
|
|
|
|
#150628 - 2005-10-26 11:28 PM
Re: WindowsXP SP2 Firewall Question
|
StarwarsKid
Seasoned Scripter
Registered: 2005-06-15
Posts: 506
Loc: Oregon, USA
|
Sure, I can be more specific. My desktop support technician is managing a public access computer lab. We currently have 4 XPSP2 computer on that network with their firewalls turned off. The DS Tech began the process of reinstalling one of the existing W2K PCs to XPSP2. After the reinstallation he set the firewall setting to OFF via our administrative user account.
I had assumed this would set the firewall for all users logging onto the system, but my DS tech is telling me that's not the case. I wanted to verify with "the think tank" before persuing the subject further.
I have installed the XPSP2 ADM templates on my Win2000 GPO for making this modification centrally, but for some reason, on this domain, the template isn't populating the GPO with the proper options for Network Connections, which includes the mods for the XP Firewall.
I'm hoping it's just a slow AD replication issue, but it may go deeper. I have another network I manage where this GPO works just fine.
One interesting thing to note is that in the GPO for modifying the Firewall there are two Profile types: Domain and Standard. Intuitively, I assume this is the difference between a domain user and a local user.... (Anyone have any insight)
_________________________
let the wise listen and add to their learning,
and let the discerning get guidance- Proverbs 1:5
|
|
Top
|
|
|
|
|
#150629 - 2005-10-27 02:20 AM
Re: WindowsXP SP2 Firewall Question
|
NTDOC
Administrator
Registered: 2000-07-28
Posts: 11634
Loc: Space
|
Yes, from what I understand the Standard is for a computer when the user logs on locally instead of the Domain.
Internet Connection Firewall Feature Overview
http://www.microsoft.com/technet/prodtechnol/winxppro/plan/icf.mspx
Quote:
Location-Aware Group Policy
ICF has a Group Policy that allows domain administrators to prevent ICF from running in their domain. This Group Policy is location-aware, which means that ICF may still be configured and run when the PC is not running on the network in which the policy was pushed down.
Here is an example scenario for this location-aware Group Policy:
• A mobile user enables and configures ICF on the wireless connection of a laptop. The user logs into the corporate domain, which applies the ICF Group Policy Object (GPO) to disable ICF from running. The user later undocks the laptop and goes to a wireless hotspot such as a café or airport and connects to this wireless network. Because ICF detects that it is no longer connected to the domain that enforced the policy, ICF will provide protection while on this hotspot network. When the user returns to the corporate network, ICF detects that its attached to the domain network that enforced the GPO and, consequently, shuts itself down.
|
|
Top
|
|
|
|
|
#150633 - 2005-10-27 06:50 PM
Re: WindowsXP SP2 Firewall Question
|
StarwarsKid
Seasoned Scripter
Registered: 2005-06-15
Posts: 506
Loc: Oregon, USA
|
!!!! Found the problem !!!!
Although, I've never experienced this before. Here it is.
In windows 2000, the default Admin Templates are CONF, INETRES, and SYSTEM.
I removed these default Templates and replaced them with the CONF, INETRES, and SYSTEM templates from a WinXP SP2 installed workstation.
After applying the change to my GPO, I go back into the Add/Remove Templates window, and see that the CONF and INETRES files are the same date and size of the new XP SP2 Templates, but SYSTEM is still the old size and file date.
Has anyone experienced this before? I'm going to grab another copy of SYSTEM from a different source and try that out. I'll let everyone know if that fixes it.
::EDIT::
Okay, this is getting freaky. It appears that, every time I access the GPO, the SYSTEM.adm file is replaced with the original Win2000 version. I've manually added it directly to the GPO policy folder on BOTH domain controllers and have watched the new file replicate properly. After I access the GPO, the SYSTEM.adm file is back to its Win2000 version.
Anyone hear of this before?
_________________________
let the wise listen and add to their learning,
and let the discerning get guidance- Proverbs 1:5
|
|
Top
|
|
|
|
|
#150634 - 2005-10-27 07:23 PM
Re: WindowsXP SP2 Firewall Question
|
NTDOC
Administrator
Registered: 2000-07-28
Posts: 11634
Loc: Space
|
I think so... Microsoft has some articles of how to properly do this. Haven't done this stuff for a while now (no AD to play with now ) 
Anyways, make sure you're using the new Group Policy Management tool which will disable the built-in GPO edit you would normally see. Then there is information about how/why changes need to be done on the Server 2000 since it does not have/understand the newer values that will show on XP.
Sorry, but you'll have to do some Googling for the links yourself.
|
|
Top
|
|
|
|
Moderator: Arend_, Allen, Jochen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Mart
|
0 registered
and 1471 anonymous users online.
|
|
|
. Use it all the time.
