asked on Enable iSCSI service on Windows firewall through Group Policy
Are setup: Windows 7 32bit OS, Server 2008R2
I want to enable iSCSI service tcp-in for all networks on the firewall. I would like to do this through Group Policy. I have tried adding this already and created a rule but it will not apply. I have tested just turning the firewall off and it works fine, but I would prefer not to do that for just one thing. I know I do this in Computer Config\Policies\Windows Settings\Security Settings and then Firewall. When I applied and checked with gpresult /r on the PC I am testing on it says "denied access".
Any assistance is appreciated. Let me know if you have any questions.
Thank you,
I want to enable iSCSI service tcp-in for all networks on the firewall. I would like to do this through Group Policy. I have tried adding this already and created a rule but it will not apply. I have tested just turning the firewall off and it works fine, but I would prefer not to do that for just one thing. I know I do this in Computer Config\Policies\Windows Settings\Security Settings and then Firewall. When I applied and checked with gpresult /r on the PC I am testing on it says "denied access".
Any assistance is appreciated. Let me know if you have any questions.
Thank you,
Windows 7Software FirewallsWindows Server 2008
Last Comment
arnold
ASKER
Yea, we are using the iSCSI service to do discovery. We have an application that will detect what user is on a specific computer. Do you mean allowing port 3260? Do I need to run the gpmc from the PC I am trying to apply it to?
You would run GPMC on the DC and then use the group policy results wizard to see what policy applies to a computer/user and there you should see why a setting is not being applied i.e. there is another policy that is processed first and is the one the sets the item, i.e. causing a conflict. you could enforce the policy to make sure it takes precedent over all others.
You're probably getting a "denied access" because of security filtering. If you could provide what settings you are using for this on your GPO as Arnold asked, it would be helpful.
If you're not too familiar with group policy, computer settings have to apply to computer objects in AD. You should link the GPO to an OU (or it's parent OU) that has the computer objects you want to apply to (if you have set up an OU for this purpose), or you can link at the domain level (if all your computers are in the default computers container). If you have security filtering set to "Authenticated Users" it will match both users and computers. If you think this sounds like a problem, that's not necessarily true. If your GPO only has computer settings, it won't apply to users and vice versa.
If you're not too familiar with group policy, computer settings have to apply to computer objects in AD. You should link the GPO to an OU (or it's parent OU) that has the computer objects you want to apply to (if you have set up an OU for this purpose), or you can link at the domain level (if all your computers are in the default computers container). If you have security filtering set to "Authenticated Users" it will match both users and computers. If you think this sounds like a problem, that's not necessarily true. If your GPO only has computer settings, it won't apply to users and vice versa.
ASKER
So would it be best to create an OU - maybe called Firewall, add all the OU's I created for each dept - add them in and then put that in the GP?
ASKER CERTIFIED SOLUTION
THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
There are other methods to have users setup with a GPO login script that will reord the user that logged into a system. The script can add the data to a flat file or into a database depending on your needs.
Are you allowing port 3250 for the discovery?
Use gpmc to get info policy events to see why it is being denied.