Activate Remote Desktop Connection + Firewall

[Incroyable HULK]

Hello all,

I have this regtweak that enable the RDC in the Control Panel:

;Activate Remote Desktop Connection
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server]
"fDenyTSConnections"=dword:00000000
"fAllowToGetHelp"=dword:00000001

I've been searching around but I still haven't found what I am looking for (nice tune from U2)

I want to enable the RDC in the SP2 Firewall as well!

Usually, if you click to activate the RDC, the firewall will be configured automatically but not with this regtweak

Any tweak?

[jfmartel]

Use this in your reg tweak file

;Enable remote desktop

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server]

"fDenyTSConnections"=dword:00000000

Use this in your winnt.sif file

[TerminalServices]

AllowConnections=1

PermissionsSetting=0

For your exception

Add

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List] OR

<EDIT>[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]</EDIT>

"3389:TCP"="3389:TCP:*:Enabled:@xpsp2res.dll,-22009"

"139:TCP"="139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004"

"445:TCP"="445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005"

"137:UDP"="137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001"

"138:UDP"="138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002"

In my case it's domain profile (other could be standard profile)

You should set your tweak in your Windows Firewall control panel.

Then export your key and add it to your regtweaks file

Hope this help!

<EDIT>Sorry for error</EDIT>

[Ghost82]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List] OR

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"3389:TCP"="3389:TCP:*:Enabled:@xpsp2res.dll,-22009"

"139:TCP"="139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004"

"445:TCP"="445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005"

"137:UDP"="137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001"

"138:UDP"="138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002"

In my case it's domain profile

erhm... both keys are the same?

[jfmartel]

Edited my post

Thanks for notification....

[Incroyable HULK]

Hum... It didn't work

I used this one since our computers are not joined to the domain during the Unattended Installation process

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\SandardProfile\GloballyOpenPorts\List]
"3389:TCP"="3389:TCP:*:Enabled:@xpsp2res.dll,-22009"
"139:TCP"="139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004"
"445:TCP"="445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005"
"137:UDP"="137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001"
"138:UDP"="138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002"

Any ideas?

[jfmartel]

Add a "T" to sandard profil..

you should check your registry for complete syntax.....

Im not sure if it's "StandardProfile" or "Standard Profile".......

[Incroyable HULK]

C R A P * I should have double checked that! Missing "t"...

Anyway you are correct, it is StandardProfile

If the computer will be added later on to a domain, should I use BOTH values?

[jfmartel]

Havent tried it, i don't know if joining the domain would overwrite the value.....but thats a good idea.

But you can try it. That would preconfigure them.

Once your computer has joined the domain, you can tweak the Firewall with the GPOs

Hope this help!