What changes are required on a Windows Vista or later machine to allow GFI LanGuard to scan and deploy updates to it?

Answer

By default the  built-in firewall of Microsoft Windows Vista/Server 2008 and newer disables various ports and services.

The following settings must be made on a Windows Vista or later machine that will be scanned remotely using GFI LanGuard:

• Setting 1: Enable Windows File Printer and sharing on the remote computer for scanning
• Setting 2: Enable WMI on the machine which will be scanned remotely
• Setting 3: Remote registry must be enabled and have read/write access from the GFI LanGuard server
• Setting 4: Admin shares must be enabled and C$ read/write must be accessible from the LanGuard server
• Setting 5: Enable Remote Procedure Call (RPC) and Remote Registry on the remote machines
• Setting 6: Open ports required by LanGuard

Setting 1: Enable Windows File Printer and sharing on the machine which will be scanned remotely

Microsoft Windows Vista and Microsoft Windows Server 2008

1. Open Control Panel > Security: Allow a program through Windows Firewall > Exceptions
2. Select File and Printing Sharing
3. Confirm the changes

Microsoft Windows 7

1. Open Control Panel > System and Security
2. Under the Windows Firewall section, click Allow a program through Windows Firewall
3. Click the Change settings button
4. Select File and Printing Sharing and select Home/Work (Private)
5. Click OK to confirm changes

1. Hover over the bottom right corner of the desktop
2. Select Settings > Control Panel
3. Click System and Security
4. Under the Windows Firewall section, click Allow a app through Windows Firewall
5. Click the Change settings button
6. Select File and Printing Sharing and select Home/Work (Private)
7. Click OK to confirm changes

Setting 2: Enable WMI on the machine which will be scanned remotely

Microsoft Windows Vista and Microsoft Windows Server 2008

1. Open Control Panel > Security: Allow a program through Windows Firewall > Exceptions
2. Select Windows Management Instrumentation (WMI)
3. Confirm the changes

Microsoft Windows 7

1. Open Control Panel > System and Security
2. Under the Windows Firewall section, click Allow a program through Windows Firewall
3. Click the Change settings button
4. Select Windows Management Instrumentation (WMI) and select Home/Work (Private)
5. Click OK to confirm changes

1. Hover over the bottom right corner of the desktop
2. Select Settings > Control Panel
3. Click System and Security
4. Under the Windows Firewall section, click Allow a app through Windows Firewall
5. Click the Change settings button
6. Select Windows Management Instrumentation (WMI) and select Home/Work (Private)
7. Click OK to confirm changes

Setting 6: Allow traffic on the ports used by GFI LanGuard

The port required are specified in the article here.

Microsoft Windows Vista and Microsoft Windows Server 2008

1. Open Control Panel > Security: Allow a program through Windows Firewall 'Exceptions
2. Click Add port. In the Add port window enter the following properties:
   • Name: LanGuard deployment ports
   • Port Type : select the protocol
   • Range : Specify the port number
3. Confirm the changes

Microsoft Windows 7

1. Open Control Panel > System and Security > Windows Firewall
2. Click the Advanced Settings link
3. Right click Inbound Rules and select New Rule...
4. Select Port and click Next
5. Ensure TCP is selected
6. Select Specific local ports and enter the port number
7. Click Next to proceed
8. Select the option Allow the connection and click Next
9. Tick the options Domain and Private and click Next
10. Enter the name LanGuard deployment ports and click Finish

1. Hover over the bottom right corner of the desktop
2. Select Settings > Control Panel
3. Click System and Security > Windows Firewall
4. Click the Advanced Settings link
5. Right click Inbound Rules and select New Rule...
6. Select Port and click Next
7. Ensure the required protocol is selected
8. Select Specific local ports and enter the port number
9. Click Next to proceed
10. Select the option Allow the connection and click Next
11. Tick the options Domain and Private and click Next
12. Enter the name LanGuard deployment ports and click Finish

More Information:

• In order to scan a Microsoft Windows Vista or later machine it is required to use Domain accounts since only these accounts have the necessary privileges to access the registry and system files. Due to User Account Control (UAC) it is not possible to scan Microsoft Windows Vista or later machines using local accounts. In order to scan Microsoft Windows Vista or later remotely using local accounts it is necessary to disable UAC completely or disable UAC for remote operations only.
• User Account Control can be disabled completely by altering the security policies as follows:
  1. Open the Security Policy Manager snap-in (Start > Run > secpol.msc )
  2. In the Security Options set Run all administrators in Admin Approval Mode = Disabled
  3. Apply the changes
• UAC can also be disabled only for any remote operations taking place on the Microsoft Windows Vista or later machine. This can be done from the registry as follows:
  1. Open Registry Editor (Start > Run > Regedit)
  2. Browse to: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
  3. Create a new DWORD value: LocalAccountTokenFilterPolicy
  4. Set LocalAccountTokenFilterPolicy to 1

Note: Scripts which use external technologies like WMI, ADSI and more, require that specific ports are open for these services. You can find more information about the specific ports you need to open on the Microsoft Web Site.