Is there a way to add a range of ports to the firewall exceptions settings or
do you have to add each port, one at a time?

Tim Cross wrote:

> Is there a way to add a range of ports to the firewall exceptions
> settings or do you have to add each port, one at a time?
Hi,

Assuming you mean the builtin firewall that comes with WinXP SP2:

To use a BAT file and the NETSH.EXE FIREWALL command see the post by
Doug Knox MS-MVP here:

sp2 Firewall Port Range
http://forum.iamnotageek.com/history.../656490-1.html

A VBScript version:
http://groups.google.co.uk/group/mic...e=source&hl=en





--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scr...r/default.mspx

Torgeir Bakken (MVP) wrote:

> Tim Cross wrote:
>
>> Is there a way to add a range of ports to the firewall exceptions
>> settings or do you have to add each port, one at a time?
>
> Hi,
>
> Assuming you mean the builtin firewall that comes with WinXP SP2:
>
> To use a BAT file and the NETSH.EXE FIREWALL command see the post by
> Doug Knox MS-MVP here:
>
> sp2 Firewall Port Range
> http://forum.iamnotageek.com/history.../656490-1.html


The link above is dead, use this one instead:
http://groups.google.com/group/micro...e=source&hl=en


>
> A VBScript version:
> http://groups.google.co.uk/group/mic...e=source&hl=en
>


--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scr...r/default.mspx

I should have added through Group Policy. I know how to add these one at a
time through Group Policy, what I would like to do is to add a range, for
example 5900-5909, by adding one item through Group Policy settings. Using
NETSH this way is for single, local machine use, right? Being one of the
network admins where I work, I have to do a lot of these things through Group
Policy settings. Adding these ports one at a time is inefficient and looks
messy when you look at the Exceptions page in Windows Firewall.

"Torgeir Bakken (MVP)" wrote:

> Tim Cross wrote:
>
> > Is there a way to add a range of ports to the firewall exceptions
> > settings or do you have to add each port, one at a time?
> Hi,
>
> Assuming you mean the builtin firewall that comes with WinXP SP2:
>
> To use a BAT file and the NETSH.EXE FIREWALL command see the post by
> Doug Knox MS-MVP here:
>
> sp2 Firewall Port Range
> http://forum.iamnotageek.com/history.../656490-1.html
>
> A VBScript version:
> http://groups.google.co.uk/group/mic...e=source&hl=en
>
>
>
>
>
> --
> torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
> Administration scripting examples and an ONLINE version of
> the 1328 page Scripting Guide:
> http://www.microsoft.com/technet/scr...r/default.mspx
>

Tim Cross wrote:

> I should have added through Group Policy. I know how to add these one at a
> time through Group Policy, what I would like to do is to add a range, for
> example 5900-5909, by adding one item through Group Policy settings. Using
> NETSH this way is for single, local machine use, right? Being one of the
> network admins where I work, I have to do a lot of these things through Group
> Policy settings. Adding these ports one at a time is inefficient and looks
> messy when you look at the Exceptions page in Windows Firewall.
Hi,

No, you cannot add FW exception ranges in the Group Policy settings.

You can run the NETSH.exe script in a computer startup script (with a
GPO) that runs as part of the boot up process (before the user logs
in). It runs under the system context and has admin rights.


--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scr...r/default.mspx

Leythos wrote:

> In article <u4zZgRyyFHA.2152@TK2MSFTNGP10.phx.gbl>, Torgeir.Bakken-
> spam@hydro.com says...
>
>>No, you cannot add FW exception ranges in the Group Policy settings.
>
>
> I added ports to the GP for our domain for the XP+SP2 stations that
> created exceptions for 5900 and 5901 for VNC and it pushed out fine to
> all workstations.
>
Hi,

Yes, but you had to put in each port one for one, the OP wanted to be
able to use a format like 5900-5909...


--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scr...r/default.mspx