Firewall: allow for AD Group AND computer name

I am not sure if there is a more specific forum for windows server 2012 R2 datacenter firewall rules; if there is, then I am thankful for a pointer.
We have to define firewall rules that allow connections to certain ports only if: the user is member of an AD group AND the connection attempt originates from a computer in a list of allowed machines. The AND operator is where I fail to define the rule;
I can allow AD Group abc to access the ports and I can allow machines x, y and z to access the ports, but I don't know a way to allow connection only if both rules are met: e.g. the user is in AD group abc and uses machine y.
Is this doable? We would also consider third party tools if that is required, business wants the rule (no matter our arguments against it, e.g. the additional effort to maintain the list of computers).
Thanks in advance for any hints,
Tim

Hi Tim,
Windows Firewall is a built-in, host-based, stateful firewall therefore it can not control user access policy, may you can use TMG as internal firewall to realize that.
The related article:
How to configure Forefront TMG to block AD users from accessing internal resources
http://blogs.technet.com/b/edgeaccessblog/archive/2010/01/19/how-to-configure-forefront-tmg-to-block-ad-users-from-accessing-internal-resources.aspx
I’m glad to be of help to you!
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Similar Messages

HT204053 Our Apple ID is ok and functioning. However, I just came on as the IT for the group and cannot find how to change the name.

Our Apple ID is ok and functioning. However, I just came on as the IT for the group and cannot find how to change the name.

Assuming you mean the personal name associated with the account, as opposed to the login (which you can change if it's not an @icloud.com. @me.com or @mac.com address) you can change this at http://appleid.appla.com . Click on 'Manage your account' and then on 'Edit' next to 'Your name' and the name currently associated with the ID.

Error connecting, tap to retry, it sees my WiFi and computer name but can't connect

Hi all, I am trying to get Edge Inspect to work on my Windows 7 PC (it did work for me a few times when I had it installed as Shadow when it initally came out)
I have read through various forum posts. I am also running Mcafee Virusscan/Firewall.
In Google Chrome I have the extension installed at the little "In" symbol top right, when I click it it says Adobe Edge Inspect "On", please start the Adobe Edge Inspect Application.
I open up the lastest version of Edge Inspect (v1.0.393) on either my iPhone or iPad, it shows the name of my WiFi router and shows the name of the computer that is running Google Chrome, it looks like it is searching for a connection (shows spinner) and then it says "Error connecting, tap to retry".
I have opened up port 7682 in my Mcafee Firewall
I have shutdown all open programs
I have tried manually entering in the computer IP address via manual connect
I have updated chrome extension and ios apps to latest version
I have tried reinstalling chrome extension
I have tried at Windows Command prompt "netstat -ano" it doesnt show port 7682 being used, until I open up Google Chrome, then it shows MYCOMPUTER:7682 SYN_SENT, which I checked the PID against and yes it is Google Chrome using 7682
Any help would be great

Hi again Mark, still no luck here.
I also have a Mac in my network so I thought I'd try installing to that to see what would happen, I just installed Adobe Edge Inspect extension onto Google Chrome on that machine and restarted the iOS apps on both iPad and iPhone and they actually didnt see the Mac machine at all, still just shows the PC computer.
Also did I mention on my iPad I can still see the last time the connection actually worked (when it was called Adobe shadow, on my iPad underneath MYCOMPUTERNAME Error Connecting, tap to retry it has MYCOMPUTERNAME Last Used 24/07/12 8:59PM). Wouldnt have anything to do with a conflict with the old Adobe Shadow or anything would it, I'm pretty sure Adobe Shadow got uninstalled by default anyway, just a thought.
So I'm not sure if it can be a problem with the Router because nothing has changed with the router since the last time it successfully worked when it was Shadow? I did add the Mac machine to the network since this time, but that machine hasnt been on when I have been doing any of this testing anyway.
Also in the Edge Inspect in the Chrome browser I do not see any deviced listed, but back on the iOS App I do see the Wifi network and Computer name as discussed, so does this mean its an inbound connection issue or?
Also sent you router settings via private message etc.

MDT 2012 Windows 7 Deployment Stops At User Account and Computer Name Setup Page

I was given a sysprepped custom Windows 7 WIM image that was set up by a third party that didn't use MDT to create the WIM.
I created a task sequence to deploy it, but it never finishes. After the OS installs and it reboots, it comes up to the white setup page asking for a user name and computer name that looks like this image:
Is there a setting in MDT that can change that behavior?

Are you joining the computer to a domain?
It sounds like MDT did not create the unattend.xml file itself (or is there an unattend file already in the image itself?)
MDT needs to be able to autologin with the local admin account
From MDT in your task sequence - OS info - Edit unattend.xml you can check if your unattended file is correct.
Check what's in there for:
- computer name in 4 Specialize area - Windows-Shell-Setup_neutral (it should be empty if you want MDT to handle it).
- Also i think you need to have in the Specialize section, under Microsoft-Windows-Deployment_neutral - Run Synchronous an EnableAdmin insert
This will enable the local admin account
- Also check in phase 7 oobe System in Shell-Setup_neutral
There should be an autologon with a count of 999
Check if you have any Local Accounts there.
Finally read this:
When I am joining clients to a domain, can I avoid creating a local user
account on the computer?
Yes. To do this, create an image unattend file that adds a domain account to the Administrators group. In addition, you must delete the <LocalAccounts> section if it is present in your
unattend file (simply commenting it out will not work). An example file is below. Note that if domain join fails, Windows Deployment Services will not use the unattend file so you will be able to create a local account. For more information about creating
unattend files, see Automating Setup.
<?xml version='1.0' encoding='utf-8'?>
<unattend xmlns="urn:schemas-microsoft-com:unattend" xmlns:ms="urn:schemas-microsoft-com:asm.v3" xmlns:wcm="http://schemas.microsoft.com/WMIConfig/2002/State">
<settings pass="oobeSystem">
<component name="Microsoft-Windows-Shell-Setup" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" processorArchitecture="amd64">
<UserAccounts>
<AdministratorPassword>
<Value>password</Value>
<PlainText>true</PlainText>
</AdministratorPassword>
<DomainAccounts>
<DomainAccountList wcm:action="add">
<DomainAccount wcm:action="add">
<Group>Administrators</Group>
<Name>DomainAdmin</Name>
</DomainAccount>
<Domain>DomainName</Domain>
</DomainAccountList>
</DomainAccounts>
</UserAccounts>
</component>
</settings>
</unattend>
I tried opening the unattend.xml from the MDT workbench, but it errors out saying it cannot be done because the captured image is x86.

Would Like to Get Report of Daily Emails In and Out from Members to a DL Exchange version : 2007 I am the supervisor for the group and want to quantify this information. I do not need to see the content, just quantity is it possible ?

Would Like to Get Report of Daily Emails In and Out from Members to a DL
Exchange version : 2007
I am the supervisor for the group and want to quantify this information. I do not need to see the content, just quantity
is it possible ?

Well, distribution groups don't really have a concept of "in" or "out". They only serve to distribute messages sent to them -- unless you're asking to know who was a member of the distribution group at the time a message was sent to the DL.
Message tracking logs hold the information you want, though. You'd have to look for EXPAND events that reference the distribution group and take the sender's e-mail address from that event. If the DL is a simple one that's not a member of any other groups
you could also look for RECEIVE events sent to the e-mail address of the group and get the sender's name from that event.
You can use Powershell extract the rows of data from the logs, but you'll have to write the code to get the data out of those rows and into a format you want. Perhaps LogParser could be useful in place of Powershell?
--- Rich Matheisen MCSE&I, Exchange MVP

Getting the user name and computer name

I've been trying to find out how to do this, but can't seem to get it.
I have an AIR application that needs to get the user's login name, and computer name for verification. I can't find anywhere to do this. Is AIR able to get this information? Is there work arounds if there isn't?
It won't ever be a web app, just an AIR app.

What I did in Air 2 to accomplish that is the following:
               public function getHostName():void {
                    if(NativeProcess.isSupported) {
                         var OS:String = Capabilities.os.toLocaleLowerCase();
                         var file:File;
                         if (OS.indexOf('win') > -1) {
                              //Executable in windows
                              file = new File('C:\\Windows\\System32\\hostname.exe');
                         } else if (OS.indexOf('mac') > -1 ) {
                              //Executable in mac
                         } else if (OS.indexOf('linux')) {
                              //Executable in linux
                         var nativeProcessStartupInfo:NativeProcessStartupInfo = new NativeProcessStartupInfo();
                         nativeProcessStartupInfo.executable = file;
                         var process:NativeProcess = new NativeProcess();
                              process.addEventListener(NativeProcessExitEvent.EXIT, onExitError);
                              process.addEventListener(ProgressEvent.STANDARD_OUTPUT_DATA, onOutput);
                              process.start(nativeProcessStartupInfo);
                              process.closeInput();
               import utls.StringHelper;
               public function onOutput(event:ProgressEvent):void {
                    var strHelper:StringHelper = new StringHelper();
                    var output:String = event.target.standardOutput.readUTFBytes(event.target.standardOutput.bytesAvailable);
                         output = strHelper.trimBack(output, "\n");
                         output = strHelper.trimBack(output, "\r");
                    trace('"'+output+'"');
The package that I used is from the manual:
package utls
     public class StringHelper
          public function StringHelper()
          public function replace(str:String, oldSubStr:String, newSubStr:String):String {
               return str.split(oldSubStr).join(newSubStr);
          public function trim(str:String, char:String):String {
               return trimBack(trimFront(str, char), char);
          public function trimFront(str:String, char:String):String {
               char = stringToCharacter(char);
               if (str.charAt(0) == char) {
                    str = trimFront(str.substring(1), char);
               return str;
          public function trimBack(str:String, char:String):String {
               char = stringToCharacter(char);
               if (str.charAt(str.length - 1) == char) {
                    str = trimBack(str.substring(0, str.length - 1), char);
               return str;
          public function stringToCharacter(str:String):String {
               if (str.length == 1) {
                    return str;
               return str.slice(0, 1);
And sorry for the miss topic I just realized that it is on flex topic, but I post it either way it may be useful for anyone

Best Export Settings for DVD burning and Computer viewing

Hello,
I am trying to export a 1 hour video that I need to be compatible with standard DVD players as well as viewable on any computer.
Original footage was shot with a Canon 5d Mark ii in 24fps.
I have done all of my editing in Premiere Pro CS6. From there, I exported a high quality file to bring into Media Encoder (for trials of best output). My master file from Premiere was exported with the Preset MPEG2. The only thing I changed in the preset was VBR from 1 pass to 2 pass.. This gave me a 6.2 GB file.
I then brought that file into Media Encoder where I have tried the following presets:
MPEG2-DVD - Match Source Attributes
MPEG2-DVD - NTSC 23.976fps Widescreen High Quality
MPEG2 - HDTV 720p 23.976 High Quality
MPEG2 - NTSC DV High Quality
These settings have encountered various issues.. some have significant banding, but most importantly, none of them will play on my DVD player when I burn them to a disc.
The discs I am using are Sony DVD-RW with a 4.7GB capacity.
Where am I going wrong here? From what I've read, the format needs to be MPEG2 to be viewed on DVD... Sorry if I sound ignorant! This stuff is tricky..

First off, don't export your timeline and then take the result to AME to re-encode, this is compressing your video twice and degrading quality (not to mention takes extra time and hard drive space). Always export direct from Premiere to Media Encoder. If you must use an "intermediate" file as part of your workflow, perhaps to archive a completed video that might later be exported to other formats, then use a lossless codec such as UT or Lagarith (free downloads).
For DVDs, you MUST use "MPEG-2 DVD". Other forms of MPEG-2 are not appropriate, as the official DVD specification requires that the MPEG-2 file has certain attributes. Not recommended to use "Match Source" for ANY export, just choose an appropriate setting as needed.
This should be correct for your application - MPEG-2 DVD > NTSC 23.976fps Widescreen High Quality
If you want to encode a DVD file over 1 hour in length, then you will need to adjust the encoding bitrate so the resulting file will fit the disc. Rule of thumb is 560/minutes = bitrate, but you might round down the result a bit to allow for menu overhead and such, depending.
Once you export the "MPEG-2 DVD" file, you can NOT simply burn that file to DVD media. That is only creating a DATA disc and it will not be playable in a DVD player (though a computer or PS3/PS4 may work since they can play most media files). To make a DVD that works in all DVD players (and meets the spec), it MUST be "authored" in a program like Adobe Encore. This compiles your content and menus and all that and then writes the result to the disc in certain way so that DVD players can read the disc. If you open any DVD on your computer, you will see a folder called "VIDEO_TS" and inside that there are .vob files and others. That is a proper DVD. And once you have a proper DVD, you can't simply copy the VIDEO_TS to another disc (as DATA), you must tell the burning software to create as a "VIDEO DVD" and not DATA, or it again won't be readable in a DVD player. Very picky spec, sorry.
When using AME to export MPEG-2 DVD, it will create two files, audio and video (.m2v and .wav), you will then Import both of those into Encore together. Note that you CAN import other formats into Encore, such as .avi but Encore will then transcode that to the correct MPEG-2 format anyway, so best that you take charge and create the right media in the first place in AME before you get to Encore.
EDIT: In AME, any time that your source is higher resolution than the destination, such as HD to DVD, you can check the "Max Render Quality" button in AME to provide the best downscale quality.
EDIT 2: I see you're using DVD-RW media. That is fine for experimenting, but for delivery to clients always use good quality DVD-R or DVD+R media. DVD-RW may not have the best compatibility with players and costs more anyways. DVDs are so cheap now that I just proof to DVD-R and toss the bad ones, up to you.
Thanks
Jeff Pulera
Safe Harbor Computers

Problem accessing /config_general/null/Default.action Reason:There is no Action mapped for namespace/ config_general and action name default

in use:
vRO 5.1
eclipse 3.7.2
vRo plug-sdk 5.1
steps:
1.create a plug-in project from samples(choose solar system)
2.find the dar package and upload it by vRo configuration
3.vRo configuration said upload successfully,but the solar system configuration is not properly configued..
problem:
Problem accessing /config_general/null/Default.action Reason:There is no Action mapped for namespace/ config_general and action name default
How to solve it??
Thanks so much!!

There was problem from crm side...its working now..

HT1535 Does iTunes 11 allow for the "dragging" and "dropping" of music from a library onto a manually managed device?

It appears that iTunes 11 does not allow for the "dragging" and "dropping" of music from a library onto a manually managed device.. is that true? I am trying to drag a playlist onto my iPhone. I've done it many times before on previous versions of iTunes but now that the menu is up in the heading, I can't drag the playlist onto the icon for my iPhone.

Zmaj3 wrote:
It appears that iTunes 11 does not allow for the "dragging" and "dropping" of music from a library onto a manually managed device.. is that true?
No.
Sync you are not syncing, the ONLY way to get items onto a manually managed device is to drag and drop.
However, I feel a much simpler way is to create a playlist and add/remove songs from this playlist and autosync this playlist (or multiple playlists). I use about 6 or 7 playlists
You can still also drag & drop songs while autosycning.

Is there a setting that allows for simultaneous downloading and watching of a rental movie on ATV?

Is there a setting that allows for simultaneous downloading and watching of a rental movie on ATV?

Apple TV has no storage, it is caching the movie and needs to load a portion before playback starts. The time it takes is dependent on your network.
What is your current connection via speedtest.net?
Make sure DNS is set to auto (settings - general - network)
If on wifi try ethernet

Crm tables for sales group and sales office

Hello CRM Experts,
Can any one plz. help me to find Tables for Sales Group and Sales office.
It will be really helpful if the above fields have relation to the Business Partner.
Thanks in Advance,
Regards,
Bharat.

Hi Radek,
I feel the table which you have given is the right table but in my scenario we have created sales office and sales group(in org structure) independently in CRM, so now we need to find these values from the table independently as well as with relation to BP the table which you have provided can be used for second scenario but if we want to fetch the values of all sales office and sales group which table i have to use.
One more problem for second scenario is in BP we cant able to see the sales ofice & group values which we defined in CRM, if we can save BP with sales office and group values then only we can use the table which you have given
Highly appreciable for your replies.
Thanks,
Bharat.

CR - giving total transaction count for few groups and 0 for few groups.

For the column "No of First Call Resolution" I have to count no of interactions based on the Interaction Result, the formula is
COUNT(Interaction_ID) WHERE INTERACTION_RESULT = 'FCR'
For which, I wrote the below formula
If {14CICustomerInteractions_query.Interaction Result} = "FCR" then Count ({14CICustomerInteractions_query.Interaction_ID})
I have 33,232 interactions on the particular day I selected. When I try to group up and do the calculations it is giving total transaction count for few groups and 0 for few groups.
Need Solution

Hi,
What field is the report grouped on?
If you wish to find the no of interactions based on some condition and display it for every group, then here's what you need to do:
1) Create this formula and place this on the details section:
whileprintingrecords;
numbervar c;
If {14CICustomerInteractions_query.Interaction Result} = "FCR" then
c := c + 1;
2) Create another formula and place this one on the Group Footer:
whileprintingrecords;
numbervar c;
3) Create this formula to reset the variable and place this on the Group Header:
whileprintingrecords;
numbervar c := 0;
Let me know how this goes!
-Abhilash

Turning off Firewall's allows for VPN, iCal and other services to work.

Hello All,
Today I decided to spend the day playing around with our new Mac Leopard Server on the bench. Here is what I found today and I was hoping someone might have some insight. We setup our MacPro with one NIC to ISP via static IP and the other to our switch running the LAN. Our DNS is setup so that apple.ourdomain.com points to the static NIC. And on the inside it's running the standard 192.168.1.1/24 for the LAN. Well all services seem to be running and setup fine today but after setting up one test MacBook Pro and then connecting to dialup outside our LAN/WAN we could not gain access to iCal (kept telling us network connection failed) or to VPN. But after about an hour of playing with the Standard config I found that if I disable the firewall in server admin and server prefs then I can VPN in via PPTP and L2TP as well as connect to iCal and to the Wiki/Webservices.
I had been trying for an hour and watching the logs for all services to find a failure as to why this remote workstation could not gain access to services inside but now I know for sure it's the built in firewall. Has anyone else seen this and do any of you regulars have any suggestions? I can put a Cisco PIX in front of the MacPro but the built in IP Chains firewall that I have disabled to give me remote services should be more than suffice to protect my calendar. I mean it's not like I am hiding the cure for cancer here...
DM

Here is the current output.
00001 allow udp from any 626 to any dst-port 626
00010 divert 8668 ip from any to any via en0
01000 allow ip from any to any via lo0
01010 deny ip from any to 127.0.0.0/8
01020 deny ip from 224.0.0.0/4 to any in
01030 deny tcp from any to 224.0.0.0/4 in
12300 allow tcp from any to any established
12301 allow tcp from any to any out
12302 allow tcp from any to any dst-port 22
12302 allow udp from any to any dst-port 22
12303 allow udp from any to any out keep-state
12304 allow tcp from any to any dst-port 53 out keep-state
12304 allow udp from any to any dst-port 53 out keep-state
12305 allow udp from any to any in frag
12306 allow tcp from any to any dst-port 311
12307 allow tcp from any to any dst-port 625
12308 allow udp from any to any dst-port 626
12309 allow icmp from any to any icmptypes 8
12310 allow icmp from any to any icmptypes 0
12311 allow igmp from any to any
12312 allow udp from any to any dst-port 1701
12313 allow tcp from any to any dst-port 1723
12314 allow tcp from any to any dst-port 113
12315 allow udp from any to any dst-port 500
12316 allow tcp from any to any dst-port 5190
12316 allow udp from any to any dst-port 5190
12317 allow tcp from any to any dst-port 5222
12318 allow tcp from any to any dst-port 5223
12319 allow tcp from any to any dst-port 5269
12320 allow udp from any to any dst-port 5297,5678
12321 allow tcp from any to any dst-port 5298
12321 allow udp from any to any dst-port 5298
12322 allow gre from any to any
12323 allow ip from 192.168.1.0/24 to any via en1 keep-state
12324 allow udp from any 68 to any dst-port 67 via en1
65534 deny ip from any to any
65535 allow ip from any to any
Devin

When I start firefox it asks for my name, password and computer name everytime

Every time I click on the icon to start Firefox, it asks for my email address and password, then asks for my computer name. I have selected Facebook as my home page but it still asks me this when I go into Firefox. It is really aggravating now, can anything be done as it never used to do this before. Has been doing it now for a few weeks. Thank you.

You need to enter both serial numbers, first the Aperture 3 upgrade number, then the Aperture 2 number.
If Aperture does not accept the numbers, see:
Troubleshooting Professional Application Serial Numbers:
http://support.apple.com/kb/TS2005
And if nothing helps, contact Apple with aproof of purchase, see:
Pro Application Replacement Serial Numbers
Regards
Léonie

Ideas for lastest chipsets and computing hardware

i have many ideas for silicone based builds and i would like input from everyone if you wish.
discrete graphics are great and i believe that both Intel and AMD have made great recent leaps in this architecture and i give them both respect.
i believe low cas is the way to go for memory to assist in optimal multi-core usage and rendering capability.
3-d technology looks amazing to me although i have yet to try it out myself as well as a lot of the newest touch screens.
i would like to see 4-8 system threads with high physics per thread and as low of frequency as possible for less power draw after all if we are going to be innovative we should be energy efficient at the same time.
my point of view is from a gamers and over clocking perspective with little understanding of the hard work that goes into the programming and server end of the computing industry.

In before Mike!
Unfortunately your post is off topic here, in the TechNet Site Feedback forum, because it is not Feedback about the TechNet Website or Subscription. This is a standard response I’ve written up in advance to help many people (thousands, really.)
who post their question in this forum in error, but please don’t ignore it. The links I share below I’ve collected to help you get right where you need to go with your issue.
For technical issues with Microsoft products that you would run into as an
end user of those products, one great source of info and help is
http://answers.microsoft.com, which has sections for Windows, Hotmail, Office, IE, and other products. Office related forums are also here:
http://office.microsoft.com/en-us/support/contact-us-FX103894077.aspx
For Technical issues with Microsoft products that you might have as an
IT professional (like technical installation issues, or other IT issues), you should head to the TechNet Discussion forums at
http://social.technet.microsoft.com/forums/en-us, and search for your product name.
For issues with products you might have as a Developer (like how to talk to APIs, what version of software do what, or other developer issues), you should head to the MSDN discussion forums at
http://social.msdn.microsoft.com/forums/en-us, and search for your product or issue.
If you’re asking a question particularly about one of the Microsoft Dynamics products, a great place to start is here:
http://community.dynamics.com/
If you really think your issue is related to the subscription or the TechNet Website, and I screwed up, I apologize! Please repost your question to the discussion forum and include much more detail about your problem, that could include screenshots
of the issue (do not include subscription information or product keys in your screenshots!), and/or links to the problem you’re seeing.
If you really had no idea where to post this question but you still posted it here, you still shouldn’t have because we have a forum just for you! It’s called the Where is the forum for…? forum and it’s here:
http://social.msdn.microsoft.com/forums/en-us/whatforum/
Moving to off topic.
Thanks, Mike
MSDN and TechNet Subscriptions Support

Firewall: allow for AD Group AND computer name

Similar Messages

Maybe you are looking for