Provisioning Resources › Deployment to Windows Vista, Windows 2008 and Windows XP Computers Running Firewall Software

Deployment to Windows Vista, Windows 2008 and Windows XP Computers Running Firewall Software

To enable deployment of agents to computers running firewall software, consider the following:

• If the firewall of a target computer running Windows Vista or Windows 2008 operating system is off (disabled) and deployment to the computer fails, create or set the following registry variable so that it is a DWORD type with a value 0x1:

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy
  

  This is required because User Account Control (UAC) in Windows Vista or Windows 2008 does not automatically grant administrative rights to local users. This occurs even though the local users are members of the Administrators group.

  Note: Setting this value will result in remote UAC access token filtering being disabled.

  Setting this value is only worthwhile if the user has a local administrator account on the computer running Windows Vista or Windows 2008. Domain administrators will not benefit from this change.

• If the firewall of a target computer running Windows Vista or Windows 2008 is on (enabled), the following ports should be opened in addition to file sharing ports, to enable deployment to that computer:

  UDP ports

  CAM: 4104

  File and printer sharing, and so on: 137, 138

  TCP ports

  IDManager: 135

  File and printer sharing, and so on: 139, 445

• If deployment still fails, the following Outbound Rules in the firewall for Windows Vista or Windows 2008 should be fully enabled:
  • Remote Assistance
  • Network Discovery
  • File and Printer Sharing
  • Core Networking
• To enable agent deployment to Windows XP computers that run firewall software you must perform the following actions manually:
  1. Change Security Policy Network Access: Sharing and security model for local accounts from 'Guest only - local users authenticate as Guest' to 'Classic - local users authenticate as themselves'.

     The Classic model allows fine control over access to resources and prevents network logons that use local accounts from being mapped to the Guest account, which typically has Read Only access to a given resource.

  2. Configure the following firewall settings:
     • Allow File and Printer Sharing
     • Open UDP Port 4104
     • Open TCP Port 135