Hi,

I wonder if one can use the gpo's in Windows 2003 server to set the client
machines to turn on their firewall (xp sp2) when they are outside the domain,
and turn it off when the computer is back in the domain again?
In case it's possible, how does one do that?

if youre not logging on to the domain then obviously gpo's wont apply


Show quoteHide quote

Hi there

I'm not too sure if it is possible, but once the windows firewall is turned
on via a gpo, as long as the user does not have administrative rights, it is
almost impossible for them to turn it off when outside of the domain.

To what end are you trying to enable the firewall when the users are outside
of the domain? If it's to stop them connecting to another ISP and surf the
web etc, I've found the simplest solution is simply to add your own DNS
servers via the GPO. Even if they do connect, they cannot browse anything.

Regards

Gareth Saunders
BOFH

Show quoteHide quote

EysteinHS wrote:
Windows 2K3 has GPO settings for Domain and Standard. My understanding
is that the Domain settings apply for machines that are connected
directly and logging on to the domain, whereas the Standard is for
remote users (laptops) for when they are not directly connected to the
domain. Haven't tested that yet, so don't know how well it works or what
mechanism determines whether the machine is connected or remote. See
http://www.microsoft.com/technet/security/smallbusiness/prodtech/windowsxp/fwgrppol.mspx
for more info.

Here is a thought:

Since the pecking order is Local, Site, Domain and then OU why not set that
local policy on the system (gpedit.msc) to be on but then set a 'Domain'
based GPO (probably you would link this GPO to the OU in which the computer
account objects would physically reside...or link this GPO to the domain
level and use security group filtering) that turns it off.

This way, at least in theory, when the system is simply part of a workgroup
(read: not in the domain) the local policy will be in affect but once the
system is joined to the domain (and placed in the correct container) the
domain level GPO will apply.

Now, these are .adm files so there is probably some registry tattooing going
on.  This might cause a problem.

Show quoteHide quote

New Site DC [WildPacket]
GC not responding
restrict access to AD:USER properties for a particular set of user
logon to domain while dc is colsed
Lots of Event ID 566
ADAM replication with firewall
NSLookup - [WildPacket]
Change Active Directory Information
Problems installing Active Directory Users and Computers on Windows 64bit
Exporting AD Objects by creation date