Tags:Microsoft, Windows Server, 2003, AD 2003 domain controller & client communication behind a firewall
For a number of reasons I need to set up my firewall to allow all domain-related communication between a 2003 Domain Controller on my internal network and a member server on the DMZ.
I have poured through all related articles in EE, and everything seems to refer to a DC-to-DC communication setup through a firewall. I have set up the following ports for both-way communication: ICMP, Kerveros, LDAP, LDAP SSL, Microsoft-DS, NetBIOS (DGM, NS & SSN), NTP and RPC.
No good!!! I'm getting EventID 1053 errors on the Application log: "Windows cannot determine the user or computer name (There are no more endpoints available from the endpoint mapper). Group Policy processing aborted."
Surely there has to be a way to allow a client to connect through....
Group Policy To successfully apply Group Policy, a client must be able to contact a domain controller over the DCOM, ICMP, LDAP, SMB, and RPC protocols. If any one of these protocols are unavailable or blocked between the client and a relevant domain controller, policy will not apply or refresh. For a cross-domain logon, where a computer is in one domain, and the user account is in another, these protocols may be required for the client, the resource domain, and the account domain to communicate. ICMP is used for slow link detection. For more information about slow link detection, click the following article number to view the article in the Microsoft Knowledge Base: 227260 (http://support.microsoft.com/kb/227260/) How a slow link is detected for processing user profiles and Group Policy System service name: Group Policy Application protocol Protocol Ports DCOM TCP + UDP random port number between 1024 - 65535 ICMP (ping) ICMP LDAP TCP 389 SMB TCP 445 RPC TCP 135, random port number between 1024 - 65535* * For more information about how to customize this port, see the "Domain controllers and Active Directory" section in the "References" section.
==============
Looks like you will have to open up a number of ports and do some reconfiguration on your server to customise a rpc port.
