Re: Newer System.adm ?

I tried configuring the firewall with gpmc, but the policies for the
firewall do not seem to work. I have set other policies that work fine, but
the policy for the firewall to open an additional port does not work. When I
inspect the registry of a computer that is operating on the domain and under
the policies, I see nothing that shows that the policies are in place. I've
read the tech doc link you provided, but it only explains how it should work
(policies vs preferences). It doesn't explain why it doesn't work for the
ports I have tried to open. While investigating this I found that if I
manually add a port to this link:

hklm\system\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List

Then of course it works ( a workstation preference), but when the policy is
set, there are no additions to this link. While trying to figure out why I
discovered that the system.adm template actually edits this link:

hklm\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\GloballyOpenPorts\List'

This link does not exist in my workstation registries - there is no
"WindowsFirewall" key anywhere.

Maybe this means that the group policy engine on the client side is not
processing policies for additional firewall ports correctly. Has anyone
else set a policy to add an additional port to the XP SP2 firewall?

I'm using a W2K3 DC with SP1, and XP SP2. I also use GPMC SP1.

TIA

Pat.



"VMM" <VMM@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:A7D54D51-EC9B-4CD9-9FB4-3E780AFBA1A0@xxxxxxxxxxxxxxxx
> Hello Pat,
>
> There is nothing wrong with your system.adm nor needs updating. You could
> configure firewall exceptions thru your Administrative Template.
> He will be more explicit if you read the text below.
>
> "True Policies and Preferences
> The Administrative Templates CSE has control over a part of the registry
> for
> both user and computer registry hives and treats these specially. These
> parts
> are for the computer and user hives respectively:
>
> . HKEY_LOCAL_MACHINE\SOFTWARE\policies (preferred location)
>
> . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies
>
> . HKEY_CURRENT_USER\SOFTWARE\policies (preferred location)
>
> . HKEY_ CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies
>
>
> These trees cannot be modified by a non-administrator. Because all keys
> and
> values beneath these paths are erased before applying the resultant
> registry
> policy settings, the registry policies applied in these subtrees will only
> persist as long as a valid Group Policy setting exists. Policy settings
> that
> are stored in these specific locations of the registry are known as true
> policies.
>
> All the policy settings in the standard Administrative Template files that
> shipped with Windows 2000 Server and Windows Server 2003 use true
> policies.
> This prevents the behavior that was often present in Windows NT 4.0,
> whereby
> System Policies resulted in persistent settings in the user and computer
> registry. The policy remained in effect until the value was reversed,
> either
> by a counteracting policy or by editing the registry. These settings are
> stored outside the approved registry locations listed and are known as
> preferences."
>
> You can read more at
> http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/74635e11-a0e2-42e0-b3c6-a5ccbc43c931.mspx
>
> Regards,


.

Relevant Pages

  • RE: Ensuring Disabling/Uninstalation of Windows XP Firewall in LA N enviro.
    ... Since the Group Policy editor is really just a fancy GUI for making registry ... Ensuring Disabling/Uninstalation of Windows XP Firewall in LAN ... Since this is not an AD environment as yet, ...
    (Focus-Microsoft)
  • Re: Group Policy question
    ... Policies" and Local Security Policy that is a subset of local Group Policy. ... the registry directly unless given direct and cohesive instructions ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Custom GPO and suggested settings
    ... is this to say that anything not in Account Policies, Local Policies, Public ... > junk mail setting in the Policies section of the registry (which is a good ... > or computer moves out of scope of a Group Policy ... > Policies are generally considered to be 'better' than preferences. ...
    (microsoft.public.windows.group_policy)
  • Re: Why is Group Policy Limited to specific keys?
    ... "policies" sections would be). ... non policy keys just as easily. ... machine first process registry policy, it takes the contents of all of the ... overwritten by conflicting settings linked later in the processing cycle. ...
    (microsoft.public.win2000.group_policy)
  • Re: Roaming USer not on the Domain
    ... Things like the renaming of the local admin ... account and firewall policies do not cache for me. ... I do not have delete cache copies of roaming profiles policy; ...
    (microsoft.public.win2000.group_policy)
Quantcast