Firewall and Group Policy

Firewall and Group Policy
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Firewall and Group Policy Cindy 06-17-2005
Posted by =?Utf-8?B?Q2luZHk=?= on June 17, 2005, 10:03 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Hello:
I currently have disabled MS firewall on LAN connections and enabled on
Wireless and Dialup not allowing file and print sharing or remote
desktop/assistance. For my users it is more important to keep them secure
when not on our LAN which has a nice hardware firewall to protect them.

I have been toying with the idea of enabling the firewall on XP machines and
maybe 2003 servers through Group Policy allowing the exceptions necessary for
me to remotely administer the services, update virus software, install
patches, etc. My concern is Windows firewall does not allow exception for
each individual connection, seems it is a one for all configuration.

If you have Group Policy firewall connections will they also be applied when
the user is not physically connected to the domain? Even if they sign onto
domain using cached credentials?

Needless to say it is more important to protect my laptops over unsupervised
wireless and dialup connections than on our protected LAN. It would be a
nice improvement to MS firewall to allow different exceptions for each
connection.

Thanks, Cindy



Posted by =?Utf-8?B?RGF2aWQgRGF2aXM=?= on June 17, 2005, 11:09 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Yes, the GPO settings will remain intact using cached credentials.
--
David Davis, MCSE, CCNA, Security +
Network Engineer


"Cindy" wrote:

> Hello:
> I currently have disabled MS firewall on LAN connections and enabled on
> Wireless and Dialup not allowing file and print sharing or remote
> desktop/assistance. For my users it is more important to keep them secure
> when not on our LAN which has a nice hardware firewall to protect them.
>
> I have been toying with the idea of enabling the firewall on XP machines and
> maybe 2003 servers through Group Policy allowing the exceptions necessary for
> me to remotely administer the services, update virus software, install
> patches, etc. My concern is Windows firewall does not allow exception for
> each individual connection, seems it is a one for all configuration.
>
> If you have Group Policy firewall connections will they also be applied when
> the user is not physically connected to the domain? Even if they sign onto
> domain using cached credentials?
>
> Needless to say it is more important to protect my laptops over unsupervised
> wireless and dialup connections than on our protected LAN. It would be a
> nice improvement to MS firewall to allow different exceptions for each
> connection.
>
> Thanks, Cindy
>
>

Posted by Roger Abell [MVP] on June 19, 2005, 12:21 am
If you were  Registered and logged in, you could reply and use other advanced thread options
I must be missing something.
You can configure exception that are unique per network interface.
If you do as you say and enable remote management exception then
I would highly recommend that you also customize the scope of IPs
for which the exception will be allowed.

--
Roger Abell
Microsoft MVP (Windows Server: Security)
MCDBA, MCSE W2k3+W2k+Nt4
> Hello:
> I currently have disabled MS firewall on LAN connections and enabled on
> Wireless and Dialup not allowing file and print sharing or remote
> desktop/assistance. For my users it is more important to keep them secure
> when not on our LAN which has a nice hardware firewall to protect them.
>
> I have been toying with the idea of enabling the firewall on XP machines
> and
> maybe 2003 servers through Group Policy allowing the exceptions necessary
> for
> me to remotely administer the services, update virus software, install
> patches, etc. My concern is Windows firewall does not allow exception for
> each individual connection, seems it is a one for all configuration.
>
> If you have Group Policy firewall connections will they also be applied
> when
> the user is not physically connected to the domain? Even if they sign
> onto
> domain using cached credentials?
>
> Needless to say it is more important to protect my laptops over
> unsupervised
> wireless and dialup connections than on our protected LAN. It would be a
> nice improvement to MS firewall to allow different exceptions for each
> connection.
>
> Thanks, Cindy
>
>



Posted by =?Utf-8?B?VGhlIEZydXN0cmF0ZWQg on July 11, 2005, 1:53 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
There are two sets of firewall settings: domain and standard. Domain applies
when the laptop is connected to the domain (not sure about using cached
credentials). The standard firewall settings kick in when the machine is not
connected to the network, even over VPN.

We are rolling this out on our network now.

"Cindy" wrote:

> Hello:
> I currently have disabled MS firewall on LAN connections and enabled on
> Wireless and Dialup not allowing file and print sharing or remote
> desktop/assistance. For my users it is more important to keep them secure
> when not on our LAN which has a nice hardware firewall to protect them.
>
> I have been toying with the idea of enabling the firewall on XP machines and
> maybe 2003 servers through Group Policy allowing the exceptions necessary for
> me to remotely administer the services, update virus software, install
> patches, etc. My concern is Windows firewall does not allow exception for
> each individual connection, seems it is a one for all configuration.
>
> If you have Group Policy firewall connections will they also be applied when
> the user is not physically connected to the domain? Even if they sign onto
> domain using cached credentials?
>
> Needless to say it is more important to protect my laptops over unsupervised
> wireless and dialup connections than on our protected LAN. It would be a
> nice improvement to MS firewall to allow different exceptions for each
> connection.
>
> Thanks, Cindy
>
>

Similar ThreadsPosted
Group policy September 7, 2005, 11:15 am
Group Policy October 8, 2005, 7:26 am
Group Policy October 8, 2005, 12:07 pm
Group Policy May 28, 2006, 9:32 am
Group Policy Foul up July 11, 2005, 9:57 am
Group policy assistance September 18, 2006, 7:23 pm
Hidden Group Policy October 22, 2008, 9:34 am
Reset Group Policy threshold July 5, 2005, 8:09 am
Group Policy with Terminal Server July 23, 2005, 5:24 am
Group policy login script October 24, 2005, 9:48 am

The site map in XML format XML site map

Contact Us | Privacy Policy