Can SP2 Firewall be configured with Login Script in AD?

[jm]

I have started rolling out SP2. Just wondering if there is anyway to
turn ICMP (ping) back on via a login script in our domain? Thanks for
any help.

 

[Andrew Mitchell]

(e-mail address removed) (jm) said

I have started rolling out SP2. Just wondering if there is anyway to
turn ICMP (ping) back on via a login script in our domain? Thanks for
any help.

If the users are local admins you can do this using the netsh command.
netsh firewall set icmpsetting type=8 mode=ENABLE

I would recommend you don't make users local admins, and configure the
changes through a GPO instead.

 

[Oli Restorick [MVP]]

You could apply this using a computer startup script in AD without making
users admins. However, if you have AD, administering group policy from an
XP SP2 machine is the easiest way to configure the new Windows Firewall GPO
settings.

Oli

 

[jm]

I used my XP SP2 machine created a new GPO in AD Users and Computers
for my OU with all the XP machines in it. The new GPO policy, under
Computer Configuration/Adminstrative Templates/Network/Network
Connections/Windows Firewall/Domain Profile (and Standard Profile) was
set for what I needed.

Now that I have created the GPO on XP SP2 for the OU in the domain,
how can I force that. On my Windows 2000 Domain Controller I did a
search and can't find gpupdate.exe anywhere. I thought that I could
do a gpupdate /force from the DC and it would simply update all the
policies everywhere and catch my GPO for my XP machines in the
process.

Please comment. Thank you.

 

[Oli Restorick [MVP]]

The machines will refresh their policies within hours. The gpupdate utility
ships with XP and 2003, but is used to force refresh of that machine's
policy, not in the way you're describing.

The command to refresh machine settings on a Windows 2000 machine is as
follows (not that it will help you at all)

secedit /refreshpolicy machine_policy

To test the policy, use the following command once for each state (network
lead plugged in and unplugged):

netsh firewall show state

Hope this helps

Oli