Since the release of Windows XP SP2 file and printer sharing has been blocked by default in the Windows firewall.

This creates a problem for many of our tools and products. For example, our remote USB disabler cannot do its work without remotely writing the appropriate registry keys. Our Remote Control product cannot automatically install its agent without file and printer sharing. They all use this to do their magic. We are not the only ones - psexec from SysInternals needs file and printer sharing too.

There are hundreds if not thousands of tools used by IT administrators that require file and printer sharing enabled in the firewall.

If you have 10 computers it is an easy fix. You simply walk around to each of them and add an exception in the firewall. Simple. Done.

If you have 100s of computers spread across 3 states…you now have a much more difficult problem. You could write a script that executes at login. The trouble with this idea is that every user would need full administrator access to their own machine. This type of access is getting pretty rare these days, so I don’t even consider it an option.

The best method is group policy. I am going to walk you through it. My example uses Windows 2003 Server. Those of you with 2008 will find that it is almost exactly the same. If you have 2000 Server…well…you have your hands full anyway and shouldn’t even have time to read this article.

Start out by getting on your domain controller. Open “Active Directory Users and Computers”. You need to determine what group of machines your policy is going to be applied to. Some organizations will have computers under many different OUs.

To keep things simple I am going to change the group policy for the entire domain.

Right click on the domain name and go to properties:

This will bring up a properties window. You will want to move to the Group Policy tab, select the policy you want to edit (In our case it is the Default Domain Policy) and press the edit button.

This is a computer policy (It will apply to computers…not specific users), so drill down to:

Computer Configuration -> Administrative Templates -> Network -> Network Connections -> Windows Firewall

You will notice two sections under this area. A domain profile, and a standard profile. A machine will automatically determine which profile it should use by the type of network it is connected to. Directly from Microsoft, they are defined in this way:

* Domain profile The domain profile is the set of Windows Firewall settings that are needed when the computer is connected to the managed network. For example, the domain profile might contain settings for excepted traffic for the applications and services needed by a managed computer in an enterprise network.

* Standard profile The standard profile is the set of Windows Firewall settings that are needed when the computer is connected to another network. A good example is when an organization laptop computer is taken on the road and connects to the Internet using a public broadband or wireless Internet service provider. Because the organization laptop computer is directly connected to the Internet, the standard profile should contain more restrictive settings than the domain profile.

So generally speaking, I suggest only making these changes to the Domain Profile. You don’t want your sales guys hooking up to a hotel network with their file and printer sharing fully accessible.

Selecting the domain profile, and looking on the right we see what we need - “Windows Firewall: Allow file and printer sharing exception”

There are two items you need to set. First check the radio button to enabled, and then below you need to fill out a filter value. This tells the group policy what computers are allowed to connect to the machine. For our example I will put *

This value allows any computer to connect. Click OK, and allow some time to pass (15 to 30 minutes). Then your computers will pick up the new policy. If you are impatient you can go to the command line on the server and your test machine. Type: GPUPDATE /force

If I hop on one of my Vista machines we can see that it has accepted the policy:

Perfect. Now I can terrorize my programmers by rebooting all of their machines at the same time using Network Administrator

Since the release of Windows XP SP2 file and printer sharing has been blocked by default in the Windows firewall.

This creates a problem for many of our tools and products. For example, our remote USB disabler cannot do its work without remotely writing the appropriate registry keys. Our Remote Control product cannot automatically install its agent without file and printer sharing. They all use this to do their magic. We are not the only ones - psexec from SysInternals needs file and printer sharing too.

There are hundreds if not thousands of tools used by IT administrators that require file and printer sharing enabled in the firewall.

If you have 10 computers it is an easy fix. You simply walk around to each of them and add an exception in the firewall. Simple. Done.

If you have 100s of computers spread across 3 states...you now have a much more difficult problem. You could write a script that executes at login. The trouble with this idea is that every user would need full administrator access to their own machine. This type of access is getting pretty rare these days, so I don't even consider it an option.

The best method is group policy. I am going to walk you through it. My example uses Windows 2003 Server. Those of you with 2008 will find that it is almost exactly the same. If you have 2000 Server...well...you have your hands full anyway and shouldn't even have time to read this article.

Start out by getting on your domain controller. Open "Active Directory Users and Computers". You need to determine what group of machines your policy is going to be applied to. Some organizations will have computers under many different OUs.

To keep things simple I am going to change the group policy for the entire domain.

Right click on the domain name and go to properties:



This will bring up a properties window. You will want to move to the Group Policy tab, select the policy you want to edit (In our case it is the Default Domain Policy) and press the edit button.



This is a computer policy (It will apply to computers...not specific users), so drill down to:

Computer Configuration -> Administrative Templates -> Network -> Network Connections -> Windows Firewall



You will notice two sections under this area. A domain profile, and a standard profile. A machine will automatically determine which profile it should use by the type of network it is connected to. Directly from Microsoft, they are defined in this way:

* Domain profile The domain profile is the set of Windows Firewall settings that are needed when the computer is connected to the managed network. For example, the domain profile might contain settings for excepted traffic for the applications and services needed by a managed computer in an enterprise network.

* Standard profile The standard profile is the set of Windows Firewall settings that are needed when the computer is connected to another network. A good example is when an organization laptop computer is taken on the road and connects to the Internet using a public broadband or wireless Internet service provider. Because the organization laptop computer is directly connected to the Internet, the standard profile should contain more restrictive settings than the domain profile.


So generally speaking, I suggest only making these changes to the Domain Profile. You don't want your sales guys hooking up to a hotel network with their file and printer sharing fully accessible.

Selecting the domain profile, and looking on the right we see what we need - "Windows Firewall: Allow file and printer sharing exception"



There are two items you need to set. First check the radio button to enabled, and then below you need to fill out a filter value. This tells the group policy what computers are allowed to connect to the machine. For our example I will put *



This value allows any computer to connect. Click OK, and allow some time to pass (15 to 30 minutes). Then your computers will pick up the new policy. If you are impatient you can go to the command line on the server and your test machine. Type: GPUPDATE /force

If I hop on one of my Vista machines we can see that it has accepted the policy:



Perfect. Now I can terrorize my programmers by rebooting all of their machines at the same time using Network Administrator :)

A lot of interesting information and rumors were revealed this week about Microsoft's next major revision of Windows client. Here's a recap!

Windows 7’s Official Name revealed – Windows 7!

Yes people, it has been confirmed today on the Windows Vista Team Blog by Mike Nash. Windows 7’s final name is the codename that has been in use since since it was revealed.

Why did Microsoft choose ‘7’ – Mike Nash Explains

Microsoft shares their official explanation on why it was chosen. Surprisingly a lot of the thoughts I expressed were also noted in Microsoft’s post. Key points to take away include: its the 7th major release of Windows, Compatibility, delivering great improvements on top of Vista.

A better explanation on how Microsoft reached version 7

The hoopla over Windows 7’s version continues! I want to get this right and it looks like Ed Bott has the best explanation so far about how Microsoft came to reach the 7th release of Windows. The kernel version seems to be what is confusing persons the most. Because Vista is NT 6.0 and Windows 7 is NT 6.1 not NT 7.0 persons are getting confused. The key as Ed notes is not include the consumer Windows 1x, 2x, 3x and 9x releases.

Is 'Instant On' coming for Windows 7?

A post over at CNET News discusses a survey made available to certain individuals suggesting the use of a fast way to start Windows. The survey makes note of changes to how Windows would function such as in ability to change Windows configuration, run certain applications.

Thoughts on the ‘new’ Windows name

Today was a surprise for many, depending on who you talk to. Microsoft chose a low key but effective channel to announce the final branding for the next version of Windows, Windows 7. We in the Windows Enthusiast community have been accustomed to codenames then a final christening sometime during the products technical testing. I have been discussing the moniker for Windows 7 for a good while now and others in the community such as Ed Bott brought the topic up just last week.

Native .VHD Support confirmed for Windows 7 – Server version

Long Zheng posted about Microsoft supporting .VHD natively in Windows, but its looking more like a Server only feature this time around.

Paul Thurrott’s Windows 7 FAQ Update

Windows Platform Enthusiast Blogger and Community Resource, Paul Thurrott has updated his informative Frequently Asked Questions about the next release of Windows, 7. Revealed are some additional information about the deep end user functionality and user interface features being built in.

Other interesting non Windows 7 news throughout the week:

Microsoft Silverlight 2 – Available
Up Next: Windows Vista SP2

Previously:
The Week in ‘7’ – Oct. 7 – 10. 2008.

With so many distros out there, you may wonder why you should opt for Ubuntu. Well, as they say, numbers don’t lie, and Ubuntu’s popularity is not without good cause. These traits are especially crowd pleasing:

Easy to install
It’s fair to say that most Linux distributions these days are pretty easy to install (and definitely easier and faster to install than Windows). Ubuntu is right in line with these improvements, and the fact that you can install it with only a few mouse clicks while running the live CD means it is pretty much ready to go whenever you are.

Easy to use
Ubuntu is easy to use in that it is very Windows-like in operation, and yet it’s more Linux-like than other Windows user–oriented distributions.

DEB based
Ubuntu is based on the Debian distribution, which means that it utilizes Debian’s very convenient DEB package system for application handling and installation. The two preconfigured, graphical package installers that come with Ubuntu make installing applications even easier. There are so many packages available for Debian systems like Ubuntu that you are likely to find more software out there than you’ll ever know what to do with.

Up to date
Some distros are updated at a snail’s pace, while others strive to be so cutting edge that they are often plagued with bugs. Ubuntu, with its reasonable six-month release cycle, tries to stay as up-to-date as possible, while at the same time making sure that things are not released before they are ready for prime time. In this way, you are ensured of having an up-to-date yet less buggy distro at your disposal.

Dependable and robust
I know these terms come across as mere hype, but after you smack Ubuntu around a bit, you come to understand what they mean. Knock things down and around, and they bounce right back—this is very important for beginners who often have a knack for screwing things up. Nothing turns a new user off more than a twitchy system that has to be velvet gloved all the time.

Desktop user–oriented
A lot of Linux distributions, although quite capable in the desktop arena, cater more to geeks and developers, taking up valuable disk space with a lot of junk you’ll probably never use. Ubuntu’s purpose is to grab desktop market share from the Redmond folks, so the needs of the common end user are always in mind. The result is that Ubuntu’s GNOME desktop environment is a very comfy place for the average desktop user to be.

Source of Information : Ubuntu for Non-Geeks (2nd Ed)