GPO for WMI, Remote Admin, etc

[james_mitchell]

Computer Configuration->Windows Settings->Security Settings->System Services
Locate the following:
TCP/IP NetBIOS Helper (Startup Mode: Automatic)
Remote Procedure Call (RPC) (Startup Mode: Automatic)
Windows Management Instrumentation (Startup Mode: Automatic)
and set

Permissions
Type Name Permission
Allow BUILTIN\Administrators Full Control
Allow NT AUTHORITY\SYSTEM Full Control
Allow NT AUTHORITY\INTERACTIVE Read
Auditing
Type Name Access
Failure Everyone Full Control

Computer Configuration->Administrative Templates->Network/Network Connections/Windows Firewall/Domain Profile

Windows Firewall: Allow file and printer sharing exception Enabled
Allow unsolicited incoming messages from: localsubnet
Windows Firewall: Allow remote administration exception Enabled
Allow unsolicited incoming messages from: localsubnet

Computer Configuration->Administrative Templates->Network/Network Connections/Windows Firewall/Standard Profile

Windows Firewall: Allow file and printer sharing exception Enabled
Allow unsolicited incoming messages from: localsubnet
Windows Firewall: Allow remote administration exception Enabled
Allow unsolicited incoming messages from: localsubnet

[james_mitchell]

GPO/IPsec handles the localsubnet string, how ever I strongly recommend against it, I dont trust it.

[Hemoco]

Thanks James

I'll make some screenshots and add it to the knowledgebase.
Only the "localsubnet" might give some problems.