• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 898
  • Last Modified:

Enable iSCSI service on Windows firewall through Group Policy

Are setup: Windows 7 32bit OS, Server 2008R2

I want to enable iSCSI service tcp-in for all networks on the firewall. I would like to do this through Group Policy. I have tried adding this already and created a rule but it will not apply. I have tested just turning the firewall off and it works fine, but I would prefer not to do that for just one thing. I know I do this in Computer Config\Policies\Windows Settings\Security Settings and then Firewall. When I applied and checked with gpresult /r on the PC I am testing on it says "denied access".

Any assistance is appreciated. Let me know if you have any questions.

Thank you,
0
SilverSharp
Asked:
SilverSharp
  • 4
  • 2
1 Solution
 
arnoldCommented:
Not sure what the point is since the only iscsi target host is the windows 2008 server, what port are you allowing and what is the security filter you are using for the GPO?

Are you allowing port 3250 for the discovery?
Use gpmc to get info policy events to see why it is being denied.
0
 
SilverSharpAuthor Commented:
Yea, we are using the iSCSI service to do discovery. We have an application that will detect what user is on a specific computer. Do you mean allowing port 3260? Do I need to run the gpmc from the PC I am trying to apply it to?
0
 
arnoldCommented:
You would run GPMC on the DC and then use the group policy results wizard to see what policy applies to a computer/user and there you should see why a setting is not being applied i.e. there is another policy that is processed first and is the one the sets the item, i.e. causing a conflict. you could enforce the policy to make sure it takes precedent over all others.
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
footechCommented:
You're probably getting a "denied access" because of security filtering.  If you could provide what settings you are using for this on your GPO as Arnold asked, it would be helpful.

If you're not too familiar with group policy, computer settings have to apply to computer objects in AD.  You should link the GPO to an OU (or it's parent OU) that has the computer objects you want to apply to (if you have set up an OU for this purpose), or you can link at the domain level (if all your computers are in the default computers container).  If you have security filtering set to "Authenticated Users" it will match both users and computers.  If you think this sounds like a problem, that's not necessarily true.  If your GPO only has computer settings, it won't apply to users and vice versa.
0
 
SilverSharpAuthor Commented:
So would it be best to create an OU - maybe called Firewall, add all the OU's I created for each dept - add them in and then put that in the GP?
0
 
arnoldCommented:
What is the result of running gpmc on one computer? Do you have another policy that deals with firewall settings?
The GPO applies based on group memberships, so you would either need to apply this policy at the top of the ad, or added/linked to each OU.
0
 
arnoldCommented:
There are other methods to have users setup with a GPO login script that will reord the user that logged into a system.  The script can add the data to a flat file or into a database depending on your needs.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Cloud Class® Course: C++ 11 Fundamentals

This course will introduce you to C++ 11 and teach you about syntax fundamentals.

  • 4
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now