B-Rad’s Links

I was wondering if there was a way to remedy a issue where developers needed access to run RPC commands on firewalled servers. I didn’t want the developers subnet to have unrestricted access to the the servers but i needed them to have remote iisreset rights. The problem was the firewall was blocking their subnet access. Opening up TCP port 135 helped open the initial line of communication but the server would then dynamically assign the port number in the range of 1024-5000 and i couldn’t justify opening a range in the firewall that opened up 3,976 ports. After some searching I did find this article from Microsoft that states how to reduce/change the range of RPC dynamically allowed ports. http://support.microsoft.com/kb/908472

so what I did on my 2003 server was run -

rpccfg.exe -pe 5001-5021 -d 0

that command adds the following registry settings to HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Internet

Ports: REG_MULTI_SZ: 5001-5021
PortsInternetAvailable: REG_SZ: Y
UseInternetPorts: REG_SZ: Y

which basically shrinks the ports avail from 3976 to 20, which is a range i feel much more comfortable allowing the developers subnet access to in the firewall.
after running the command you will have to restart the box in order for the changes to take affect. Once i had that set and my firewall set it was smooth sailing.

B-rad

Today I had to setup a backup windows 2003 IAS server and i didn’t want to go through the process of doing it manually. After doing a little digging I found that it’s real easy to do with the netsh command.

On the IAS server that has all the settings you want to copy over run the following:

netsh aaaa show config > [file path]\file.txt

Now copy that file that was just create with the last command to the 2nd IAS server and run the following from the 2nd server:

netsh exec [file path]\file.txt

once thats done you’re done….. nothing else needed to do.

If for some reason in doing this you get a error stating “Failed attempting to show the aaaa configuration.” double check to make sure you have the “>” after the show config part in the export command.

-B-rad