System Center Essentials Policy Stops Access To Admin Shares

全部回复

• 2009年6月29日 11:21Yog Li - MSFTMSFT, 版主

   
  

  0

  登录进行投票

  Hello, 

  After SCE has been installed and configured, two GPOs are created and linked to the domain container:

  1.    System Center Essentials All Computers Policy. It is for those members of the domain but have not been managed by SCE server.

  It enables the following policies under computer configuration:

  a.    Windows Firewall: All file and printer sharing exception

  b.    Windows Firewall: Allow remoter administration exception

  2.    SCE Managed Computers Group Policy(Managment_MG).

   It enables the following policies under computer configuration for the update management component:

  a.    SYSTEM/Error Reporting

  Policy: Configure Error Reporting

  b.    System/Error Reporting/Advanced Error Reporting settings

  Policy: Default application reporting settings

             Report operating system errors

  c.    System/Internet Communication Management/ Internet Communication  settings.

  Policy: Turn off Windows Error Reporting

  d.    System/Remote Assistance.

  Policy: Offer Remote Assistance

  e.    Windows Components/Windows update

  Policy: Allow signed content from intranet Microsoft update service location

            Configure Automatic Updates

  
  No policy seems disabled the admin shares. Besides, I can visit my SCE Server by using "\\computer name\C$". What is the policy that you have disabled to resolve this issue? Please tell us more details so we can move on.

  Thanks,

  ---

  Yog Li - MSFT
  • 回复
  • 引用

   
• 2009年6月30日 2:42Hittin

   
  

  0

  登录进行投票
  Under System Center Essentials All Computers Policy/Computer Configuration/Network/Network Connections/Windows Firewall/Domain Profile see the following 2 entries:
  
  Windows Firewall: Allow file and printer sharing exception
  Windows Firewall: Allow remote administration exception
  
  Both will be locked down to the Essentials Server IP address. This then only allows the Essentials server to access the Admin shares on any machine in the domain, irrelevant if it has an Essentials agent installed or not, even if you're a Domain Admin, irrelevant.
  
  We changed ours from just the Essentials server IP address to the entire network, x.x.x.0 and all worked as it did before Essentials was installed on the domain.
  
  Hope this helps.
  
  PS. Of course Yog Li can access his Essentials server Admin shares. It's the only one in the policy allowed list!
  Try connecting to your DC or some other workstation, it won't work until you do the above, and the policy updates.

  • 已建议为答案Hittin 2009年6月30日 2:42
  • 已标记为答案Yog Li - MSFTMSFT, 版主2009年7月6日 9:35
  •  
  • 回复
  • 引用

   
• 2009年6月30日 10:58Yog Li - MSFTMSFT, 版主

   
  

  0

  登录进行投票
  Hello,
  
  Thanks Hittin for sharing the experience. The solution works in my test environment.
  
  Thanks,

  ---

  Yog Li - MSFT
  • 回复
  • 引用

   
• 2009年7月6日 9:35Yog Li - MSFTMSFT, 版主

   
  

  0

  登录进行投票

  Hi beat102,

  As this thread has been quiet for a while, we assume that the issue has been resolved. At this time, we will mark it as ‘Answered’ as the previous steps should be helpful for many similar scenarios.

  In addition, we’d love to hear your feedback about the solution. By sharing your experience you can help other community members facing similar problems.

  Thanks,

  ---

  Yog Li - MSFT
  • 回复
  • 引用

   
• 2009年8月7日 13:57Hittin

   
  

  0

  登录进行投票
  Beat102, did this resolve your issue? Thanks for the feedback.
  • 回复
  • 引用

   
• 2009年8月28日 17:00Hittin

   
  

  0

  登录进行投票
  Hey beat did you beat it or did it beat you?
  
  Feedbeat I mean back is always good
  • 回复
  • 引用