Win 2K3 firewall GPO

[SwimmerB]

Ok, I have a slight issue when applying a windows firwall reg key the add exceptions to the registry at path

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

my issue lies in the fact that on some of my systems this works and others it doesn't. I have read that the DomainProfile part of this can be when you have a domain controller on your network, but if you do not have that then use StandardProfile setting. What I am wondering since some of my machines could be in the domain and other are not will using just the standard profile work for domain machines or does it then only look at the domain profile. If this is the case I can just cover all the bases and add it to both but don't really want to.

Any insight would be great.

Thanks

[cluberti]

Ok, I have a slight issue when applying a windows firwall reg key the add exceptions to the registry at path

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

my issue lies in the fact that on some of my systems this works and others it doesn't. I have read that the DomainProfile part of this can be when you have a domain controller on your network, but if you do not have that then use StandardProfile setting. What I am wondering since some of my machines could be in the domain and other are not will using just the standard profile work for domain machines or does it then only look at the domain profile. If this is the case I can just cover all the bases and add it to both but don't really want to.

Any insight would be great.

Thanks

If a machine attached to a domain is logged into the domain it is joined to, it will be using the DomainProfile keys, and when not, will use the StandardProfile keys. If the settings are the same between the two, yes, you should (and will need to) push down both to catch both scenarios.

[SwimmerB]

Yeah that was my guess as well to do. I was trying to get away from duplicating the policy but it is not that hard to do so sounds good to me.