Procedure and the consequence when enabling the built-in firewall profiles for Domain Controllers?

Question

Procedure and the consequence when enabling the built-in firewall profiles for Domain Controllers?

EnterpriseArchitect 6,301

I need help understanding how to manually set the Windows Firewall for all Domain Controllers with Advanced Security capabilities by enabling the Active Directory Domain Services and Active Directory Web Services rule groups.

Screenshot 2024-03-16 000221

User's image

According to this official article from Microsoft: Service overview and network port requirements - Windows Server | Microsoft Learn

There are Port 49152-65535 – RPC Ephemeral Ports how do I ensure these ports are not blocked by the Windows Firewall?

Any assistance and clarity would be highly appreciated.

2 answers

Your answer

Answer 1

Thameur-BOURBITA 36,491 Moderator

Hi @EnterpriseArchitect

When you enable windows firewall , you should be sure that all ports required for domain controller are opened, for more information you can refer to the following link :

How to configure a firewall for Active Directory domains and trusts

Please don't forget to accept helpful answer

EnterpriseArchitect 6,301

Hi @Thameur-BOURBITA ,
I assume after clicking the [Use recommended settings] button, the Firewall will be enabled automatically for all 3 profiles for my domain controllers.

and because nothing is blocking from the below command result, so it will be OK?

Get-NetFirewallRule : No matching MSFT_NetFirewallRule objects found by CIM query for instances of the root/standardcimv2/MSFT_NetFirewallRule class on the  CIM server: SELECT * FROM 
MSFT_NetFirewallRule  WHERE ((Enabled = 1)) AND ((Direction = 2)) AND ((Action = 4)). Verify query parameters and retry.
At line:2 char:5
+     Get-NetFirewallRule -Action Block -Enabled True -Direction Outbou ...
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (MSFT_NetFirewallRule:String) [Get-NetFirewallRule], CimJobException
    + FullyQualifiedErrorId : CmdletizationQuery_NotFound,Get-NetFirewallRule
 
Get-NetFirewallRule : No matching MSFT_NetFirewallRule objects found by CIM query for instances of the root/standardcimv2/MSFT_NetFirewallRule class on the  CIM server: SELECT * FROM 
MSFT_NetFirewallRule  WHERE ((Enabled = 1)) AND ((Direction = 1)) AND ((Action = 4)). Verify query parameters and retry.
At line:8 char:5
+     Get-NetFirewallRule -Action Block -Enabled True -Direction Inboun ...
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (MSFT_NetFirewallRule:String) [Get-NetFirewallRule], CimJobException
    + FullyQualifiedErrorId : CmdletizationQuery_NotFound,Get-NetFirewallRule

Thameur-BOURBITA 36,491 Reputation points Moderator

2024-03-15T15:27:27.32+00:00

@EnterpriseArchitect

You should check if the default rules allows all required ports for domain controllers.

When you add new roles on windows server a firewall rule will be created automatically during the roles installation to allow all required ports.

You should check if all rules required for domain controllers alreday exist on your domain controller before enable recommened settings just to avoid any incident. You can also make network trace to check which ports used by the server. In a big and complex envirement this kind of action should be well prepared

Please don't forget to accept helpful answer
Thameur-BOURBITA 36,491 Reputation points Moderator

2024-03-22T14:17:16.1533333+00:00

@EnterpriseArchitect

Just checking if there is any progress ?

Please don't forget to accept helpful answer

Answer 2

Anonymous

Hello EnterpriseArchitect,

Thank you for posting in Q&A forum.

You can check if these ports are blocked or not by the Windows Firewall based on the way in the following link.
https://www.itechtics.com/check-windows-firewall-blocking-ports/

Also, here is a similar thread with method for your reference.

https://serverfault.com/questions/26564/how-to-check-if-a-port-is-blocked-on-a-windows-machine

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

EnterpriseArchitect 6,301 Reputation points

2024-03-18T11:33:22.42+00:00

Thank you @daisy zhou ,
Based on your suggestion, does the logging can only be retrieved when the Firewall rule is enabled?

how can I get the firewall log without blocking or activating the rules first?

Share via

Procedure and the consequence when enabling the built-in firewall profiles for Domain Controllers?

2 answers

Your answer