Skip navigation

JSI Tip 10249. How do I create a Windows NT 4.0 system policy to manage Windows Firewall in a Windows NT 4.0 domain?

Microsoft Knowledge Base Article 897100 contains the following summary and introduction:

SUMMARY

Domain administrators typically use Group Policy to manage the Windows Firewall program that is included with Microsoft Windows XP Service Pack 2 (SP2). However, Microsoft Windows NT 4.0 does not support Group Policy. Administrators cannot manage Windows Firewall by using Group Policy in a Windows NT 4.0 domain. To resolve this issue, Microsoft provides a policy template that you can use with a Windows NT 4.0 system policy to manage Windows Firewall in a Windows NT 4.0 domain. This article discusses the following tasks:

How to create a Windows NT 4.0 system policy to manage Windows Firewall
How to replicate the new system policy from the primary domain controller (PDC) to all backup domain controllers (BDCs) in the domain
How to apply the new system policy on Windows XP SP2-based client computers

INTRODUCTION

This article discusses how to download the Windows Firewall policy template and how to create a Windows NT 4.0 system policy to manage Windows Firewall in a Windows NT 4.0 domain. The following concepts relate to these tasks:

In a Windows NT 4.0 domain, you cannot add computers to groups. You have to use one of the following methods to apply a system policy to computers:

Use the Default Computer object to apply system policy settings to all computers in the domain.
Add each applicable computer to the System Policy Editor. For each computer that you add, you must configure system policy settings.

Note The procedures in this article use the Default Computer object to apply system policy settings to all computers in the domain.

Windows Firewall has two profiles, the domain profile and the standard profile. These profiles can be managed by using system policies. In a Windows NT 4.0 domain, the computer always loads the standard profile.

Note In Windows XP SP2, the Network Location Awareness service determines whether the connection-specific Domain Name System (DNS) suffix and the primary DNS suffix match. If these suffixes match, Windows Firewall loads the domain profile. Otherwise, Windows Firewall loads the standard profile. In a Windows NT 4.0 domain, the connection-specific DNS suffix and the primary DNS suffix do not match. Therefore, Windows Firewall always loads the standard profile.
When you set exceptions in Windows Firewall, you must set the scope. The scope setting controls the IP addresses from which to accept unsolicited traffic. Each exception has its own scope setting.



Hide comments

Comments

  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
Publish