System Center Essentials Policy Stops Access To Admin Shares

Fri, 26 Jun 2009 09:42:38 Z

Enabling System Center Essentials Policies made SCE working but we discover that admin shares \\computer\c$ cannot be reached any more.
Disabling these policies everything came back to normal. The SCE SP1 has been installed on Windows Server 2008.
Please advise.

System Center Essentials Policy Stops Access To Admin Shares

Mon, 29 Jun 2009 11:21:49 Z

Hello,

After SCE has been installed and configured, two GPOs are created and linked to the domain container:

1. System Center Essentials All Computers Policy. It is for those members of the domain but have not been managed by SCE server.

It enables the following policies under computer configuration:

a. Windows Firewall: All file and printer sharing exception

b. Windows Firewall: Allow remoter administration exception

2. SCE Managed Computers Group Policy(Managment_MG).

It enables the following policies under computer configuration for the update management component:

a. SYSTEM/Error Reporting

Policy: Configure Error Reporting

b. System/Error Reporting/Advanced Error Reporting settings

Policy: Default application reporting settings

Report operating system errors

c. System/Internet Communication Management/ Internet Communication settings.

Policy: Turn off Windows Error Reporting

d. System/Remote Assistance.

Policy: Offer Remote Assistance

e. Windows Components/Windows update

Policy: Allow signed content from intranet Microsoft update service location

Configure Automatic Updates

No policy seems disabled the admin shares. Besides, I can visit my SCE Server by using "\\computer name\C$". What is the policy that you have disabled to resolve this issue? Please tell us more details so we can move on.

Thanks,

Yog Li - MSFT

System Center Essentials Policy Stops Access To Admin Shares

Tue, 30 Jun 2009 02:42:33 Z

Under System Center Essentials All Computers Policy/Computer Configuration/Network/Network Connections/Windows Firewall/Domain Profile see the following 2 entries:

Windows Firewall: Allow file and printer sharing exception
Windows Firewall: Allow remote administration exception

Both will be locked down to the Essentials Server IP address. This then only allows the Essentials server to access the Admin shares on any machine in the domain, irrelevant if it has an Essentials agent installed or not, even if you're a Domain Admin, irrelevant.

We changed ours from just the Essentials server IP address to the entire network, x.x.x.0 and all worked as it did before Essentials was installed on the domain.

Hope this helps.

PS. Of course Yog Li can access his Essentials server Admin shares. It's the only one in the policy allowed list!
Try connecting to your DC or some other workstation, it won't work until you do the above, and the policy updates.

System Center Essentials Policy Stops Access To Admin Shares

Tue, 30 Jun 2009 10:58:09 Z

Hello,

Thanks Hittin for sharing the experience. The solution works in my test environment.

Thanks,

Yog Li - MSFT

System Center Essentials Policy Stops Access To Admin Shares

Mon, 06 Jul 2009 09:35:20 Z

Hi beat102,

As this thread has been quiet for a while, we assume that the issue has been resolved. At this time, we will mark it as ‘Answered’ as the previous steps should be helpful for many similar scenarios.

In addition, we’d love to hear your feedback about the solution. By sharing your experience you can help other community members facing similar problems.

Thanks,

Yog Li - MSFT

System Center Essentials Policy Stops Access To Admin Shares

Fri, 07 Aug 2009 13:57:28 Z

Beat102, did this resolve your issue? Thanks for the feedback.

System Center Essentials Policy Stops Access To Admin Shares

Fri, 28 Aug 2009 17:00:01 Z

Hey beat did you beat it or did it beat you?

Feedbeat I mean back is always good