GPO For Disable Network Discovery

Hi s
I have DC Windows Server 2008 R2 and clients with Windows 7, 8 and 8.1
I want disable users Access to computers from Network Discovery.
I apply GPO to remove Icon Network from Navigation Pane and it works perfect, but when users access to computer on network from RUN they see Network on Address bar. For example user access to Server from RUN
\\Server\ if user do Click on Network on address bar see all computers on network.
My Question is, How to prevent users see computers on network, how disable network discovery completely?
Thanks.

Hi,
>>How to prevent users see computers on network, how disable network discovery completely?
We can try the following solution to see if it helps.
In a new or existing GPO:
1. On Computer configuration, choose Policies, choose Security Settings, choose Windows Firewall with Advanced Security.
2. On Windows Firewall with Advance Settings, choose Inbound Rules, right click and choose New Rule
3. On Rule Type, select Predefined and choose Network Discovery, choose Next
4. Choose only the following rules:
a. Network Discovery (LLMNR-UDP-In)
b. Network Discovery (NP-Name-In)
c. Network Discovery (Pub-WSD-In)
d. Network Discovery (SSDP-In)
5. On Action choose Block the connection
6. Press Finish
7. On Inbound Rules, right click and choose New Rule, select Next
8. Choose only the following Rule:
a. Network Discovery (NB-Datagram-In)
9. On Action choose Allow the connection
10. Press Finish
11. On Windows Firewall with Advance Settings, choose Outbound Rules, right click and choose New Rule
12. On Rule Type, select Predefined and choose Network Discovery, choose Next
13. Choose only the following rules:
a. Network Discovery (LLMNR-UDP Out)
b. Network Discovery (NB-Name Out)
c. Network Discovery (Pub-WSD Out)
d. Network Discovery (SSDP Out)
14. On Action choose Block the connection
15. Press Finish
16. On Outbound Rules, right click and choose New Rule, select Next
17. Choose only the following Rule:
a. Network Discovery (NB-Datagram Out
18. On Action choose Allow the connection
19. Press Finish
20. On Computer configuration, choose Policies, choose Security Settings, choose System Services
21. Choose Computer Browser Service
22. Select Define this policy setting
23. Choose Disabled, choose Apply and Ok.
24. Repeat steps (21-23) for the following services:
a. SSDP Discovery
b. UPnP Device Host
c. Function Discovery Resource Publication
d. Function Discovery Provider host
e. Link-Layer Topology Discovery Mapper
After configuring the GPO, link this GPO to our target OU, and we can run gpupdate/force to immediately update group policy.
Best regards,
Frank Shen
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected].

Similar Messages

How can i disable network discovery

i have domain with windows server 2008 and some pc's with windows 7
how can i disable network discovery from this pc's using group policy from domain

Hi,
>>how can i disable network discovery from this pc's using group policy from domain
In addition, the following thread can be referred to as reference.
Network Discovery GPO to Disable It.
https://social.technet.microsoft.com/Forums/windowsserver/en-US/ae458fcf-a6cb-4e9b-905a-2982fbb0dba3/network-discovery-gpo-to-disable-it?forum=winserverGP
Best regards,
Frank Shen

How to disable Windows from prompting to enable Network Discovery

After deploying a new Windows 2012R2 VM, running sysprep, we then run powershell script to automatically configure a server how we want it.
One of these steps is to disable the Windows firewall in all profiles with this powershell line:
Set-NetFirewallProfile -name * -Enabled "false"
However, when I first login to the server, it prompt me to turn on/off network discovery:
"Do you want to find PCs, devices, and content on this network, and automatically connect to devices like printers and TVs?"
If I select "No", it enables the Windows Firewall on the public profile.
How do I prevent the server from prompting for this information?
I was thinking off disabling Network Discovery in the powershell script to turn it 'off' but not sure how to do this.
Thanks

Hi,
Did you try the command:
Disable-NetFirewallRule –DisplayName "Network Discovery"
https://technet.microsoft.com/en-us/library/jj554843.aspx
Regards.
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Enabling network discovery on Windows Server 2012 R2

Good afternoon.
As per the title, I have set-up a new server at work. The server is running no problem but none of the other computers connected to the network can 'see' the new server. I've gone into the control panel and tried to turn on the network discovery, but it just
defaults back to 'off'.
I did so a search on here first before troubling anyone and I did find this answer :
Thanks for the post.
I did some research and found this issue may occur if the dependency services are disabled. Please make sure the following services are enabled and running.
- SSDP Discovery
- UPnP Device Host
Disabling Network Discovery/Network Resources"
That may well be the answer, but unfortunately that means absolutely nothing to me.
Is someone able to help me try and switch this on, but by offering an explanation an 'idiot' would understand.
Thanks in advance.

Hi,
This issue occurs for one of the following reasons:
•The dependency services for Network Discovery are not running.
•The Windows firewall or other firewalls do not allow Network Discovery.
To resolve the issue, follow these steps:
1.Make sure that the following dependency services are started:
DNS Client
Function Discovery Resource Publication
SSDP Discovery
UPnP Device Host
2.Configure the Windows firewall to allow Network Discovery. To do this, follow these steps:
Open Control Panel, click System and Security, and then click Windows Firewall.
In the left pane, click Allow an app or feature through Windows Firewall if you are running Windows Server 2012. Or, click Allow a program or feature through Windows Firewall if you are running Windows Server 2008 or Windows Server 2008 R2.
Click Change settings. If you are prompted for an administrator password or confirmation, type the password or provide confirmation.
Select Network discovery, and then click OK.
3.Configure other firewalls in the network to allow Network Discovery.
4.Turn on Network Discovery in Network and Sharing Center
Quote from http://support.microsoft.com/kb/2722035
Steven Lee
TechNet Community Support

2008 R2 GPO - Turn network discovery on not working

Hi
I'm migrating several computers into a new domain with ADMT but all computer migrated (XP,7 and 8) could not enable network discovery.
I've made a GPO (found on technet) that should work but users still are unable to browse network. Gpo is applied (checked with rsop) and sincerly i've no ideas on what to check to understand why the GPO is not working. Any idea on something to check or change?
I copy the gpo here to check it.. thanks in advance
Computer Configuration (Enabled)hide
Policieshide
Windows Settingshide
Security Settingshide
Windows Firewall with Advanced Securityhide
Global Settingshide
Policy
Setting
Policy version
2.10
Disable stateful FTP
Not Configured
Disable stateful PPTP
Not Configured
IPsec exempt
Not Configured
IPsec through NAT
Not Configured
Preshared key encoding
Not Configured
SA idle time
Not Configured
Strong CRL check
Not Configured
Inbound Ruleshide
Name
Description
Network Discovery (Pub-WSD-In)
Inbound rule for Network Discovery to discover devices via Function Discovery. [UDP 3702]
This rule may contain some elements that cannot be interpreted by current version of GPMC reporting module
Enabled
True
Program
%SystemRoot%\system32\svchost.exe
Action
Allow
Security
Require authentication
Authorized computers
Authorized users
Protocol
17
Local port
3702
Remote port
Any
ICMP settings
Any
Local scope
Any
Remote scope
Local subnet
Profile
All
Network interface type
All
Service
fdrespub
Allow edge traversal
False
Group
Network Discovery
Network Discovery (LLMNR-UDP-In)
Inbound rule for Network Discovery to allow Link Local Multicast Name Resolution. [UDP 5355]
This rule may contain some elements that cannot be interpreted by current version of GPMC reporting module
Enabled
True
Program
%SystemRoot%\system32\svchost.exe
Action
Allow
Security
Require authentication
Authorized computers
Authorized users
Protocol
17
Local port
5355
Remote port
Any
ICMP settings
Any
Local scope
Any
Remote scope
Local subnet
Profile
All
Network interface type
All
Service
dnscache
Allow edge traversal
False
Group
Network Discovery
Network Discovery (WSD-In)
Inbound rule for Network Discovery to discover devices via Function Discovery. [UDP 3702]
This rule may contain some elements that cannot be interpreted by current version of GPMC reporting module
Enabled
True
Program
%SystemRoot%\system32\svchost.exe
Action
Allow
Security
Require authentication
Authorized computers
Authorized users
Protocol
17
Local port
3702
Remote port
Any
ICMP settings
Any
Local scope
Any
Remote scope
Local subnet
Profile
All
Network interface type
All
Service
fdphost
Allow edge traversal
False
Group
Network Discovery
Network Discovery (SSDP-In)
Inbound rule for Network Discovery to allow use of the Simple Service Discovery Protocol. [UDP 1900]
This rule may contain some elements that cannot be interpreted by current version of GPMC reporting module
Enabled
True
Program
%SystemRoot%\system32\svchost.exe
Action
Allow
Security
Require authentication
Authorized computers
Authorized users
Protocol
17
Local port
1900
Remote port
Any
ICMP settings
Any
Local scope
Any
Remote scope
Local subnet
Profile
All
Network interface type
All
Service
Ssdpsrv
Allow edge traversal
False
Group
Network Discovery
Network Discovery (WSD Events-In)
Inbound rule for Network Discovery to allow WSDAPI Events via Function Discovery. [TCP 5357]
This rule may contain some elements that cannot be interpreted by current version of GPMC reporting module
Enabled
True
Program
System
Action
Allow
Security
Require authentication
Authorized computers
Authorized users
Protocol
6
Local port
5357
Remote port
Any
ICMP settings
Any
Local scope
Any
Remote scope
Any
Profile
All
Network interface type
All
Service
All programs and services
Allow edge traversal
False
Group
Network Discovery
Network Discovery (WSD EventsSecure-In)
Inbound rule for Network Discovery to allow Secure WSDAPI Events via Function Discovery. [TCP 5358]
This rule may contain some elements that cannot be interpreted by current version of GPMC reporting module
Enabled
True
Program
System
Action
Allow
Security
Require authentication
Authorized computers
Authorized users
Protocol
6
Local port
5358
Remote port
Any
ICMP settings
Any
Local scope
Any
Remote scope
Any
Profile
All
Network interface type
All
Service
All programs and services
Allow edge traversal
False
Group
Network Discovery
Network Discovery (NB-Datagram-In)
Inbound rule for Network Discovery to allow NetBIOS Datagram transmission and reception. [UDP 138]
This rule may contain some elements that cannot be interpreted by current version of GPMC reporting module
Enabled
True
Program
System
Action
Allow
Security
Require authentication
Authorized computers
Authorized users
Protocol
17
Local port
138
Remote port
Any
ICMP settings
Any
Local scope
Any
Remote scope
Any
Profile
All
Network interface type
All
Service
All programs and services
Allow edge traversal
False
Group
Network Discovery
Network Discovery (NB-Name-In)
Inbound rule for Network Discovery to allow NetBIOS Name Resolution. [UDP 137]
This rule may contain some elements that cannot be interpreted by current version of GPMC reporting module
Enabled
True
Program
System
Action
Allow
Security
Require authentication
Authorized computers
Authorized users
Protocol
17
Local port
137
Remote port
Any
ICMP settings
Any
Local scope
Any
Remote scope
Any
Profile
All
Network interface type
All
Service
All programs and services
Allow edge traversal
False
Group
Network Discovery
Network Discovery (UPnP-In)
Inbound rule for Network Discovery to allow use of Universal Plug and Play. [TCP 2869]
This rule may contain some elements that cannot be interpreted by current version of GPMC reporting module
Enabled
True
Program
System
Action
Allow
Security
Require authentication
Authorized computers
Authorized users
Protocol
6
Local port
2869
Remote port
Any
ICMP settings
Any
Local scope
Any
Remote scope
Any
Profile
All
Network interface type
All
Service
All programs and services
Allow edge traversal
False
Group
Network Discovery
Outbound Ruleshide
Name
Description
Network Discovery (Pub WSD-Out)
Outbound rule for Network Discovery to discover devices via Function Discovery. [UDP 3702]
This rule may contain some elements that cannot be interpreted by current version of GPMC reporting module
Enabled
True
Program
%SystemRoot%\system32\svchost.exe
Action
Allow
Security
Require authentication
Authorized computers
Protocol
17
Local port
Any
Remote port
3702
ICMP settings
Any
Local scope
Any
Remote scope
Local subnet
Profile
All
Network interface type
All
Service
fdrespub
Group
Network Discovery
Network Discovery (LLMNR-UDP-Out)
Outbound rule for Network Discovery to allow Link Local Multicast Name Resolution. [UDP 5355]
This rule may contain some elements that cannot be interpreted by current version of GPMC reporting module
Enabled
True
Program
%SystemRoot%\system32\svchost.exe
Action
Allow
Security
Require authentication
Authorized computers
Protocol
17
Local port
Any
Remote port
5355
ICMP settings
Any
Local scope
Any
Remote scope
Local subnet
Profile
All
Network interface type
All
Service
dnscache
Group
Network Discovery
Network Discovery (WSD-Out)
Outbound rule for Network Discovery to discover devices via Function Discovery. [UDP 3702]
This rule may contain some elements that cannot be interpreted by current version of GPMC reporting module
Enabled
True
Program
%SystemRoot%\system32\svchost.exe
Action
Allow
Security
Require authentication
Authorized computers
Protocol
17
Local port
Any
Remote port
3702
ICMP settings
Any
Local scope
Any
Remote scope
Local subnet
Profile
All
Network interface type
All
Service
fdphost
Group
Network Discovery
Network Discovery (UPnPHost-Out)
Outbound rule for Network Discovery to allow use of Universal Plug and Play. [TCP]
This rule may contain some elements that cannot be interpreted by current version of GPMC reporting module
Enabled
True
Program
%SystemRoot%\system32\svchost.exe
Action
Allow
Security
Require authentication
Authorized computers
Protocol
6
Local port
Any
Remote port
Any
ICMP settings
Any
Local scope
Any
Remote scope
Local subnet
Profile
All
Network interface type
All
Service
upnphost
Group
Network Discovery
Network Discovery (SSDP-Out)
Outbound rule for Network Discovery to allow use of the Simple Service Discovery Protocol. [UDP 1900]
This rule may contain some elements that cannot be interpreted by current version of GPMC reporting module
Enabled
True
Program
%SystemRoot%\system32\svchost.exe
Action
Allow
Security
Require authentication
Authorized computers
Protocol
17
Local port
Any
Remote port
1900
ICMP settings
Any
Local scope
Any
Remote scope
Local subnet
Profile
All
Network interface type
All
Service
Ssdpsrv
Group
Network Discovery
Network Discovery (WSD Events-Out)
Outbound rule for Network Discovery to allow WSDAPI Events via Function Discovery. [TCP 5357]
This rule may contain some elements that cannot be interpreted by current version of GPMC reporting module
Enabled
True
Program
System
Action
Allow
Security
Require authentication
Authorized computers
Protocol
6
Local port
Any
Remote port
5357
ICMP settings
Any
Local scope
Any
Remote scope
Any
Profile
All
Network interface type
All
Service
All programs and services
Group
Network Discovery
Network Discovery (WSD EventsSecure-Out)
Outbound rule for Network Discovery to allow Secure WSDAPI Events via Function Discovery. [TCP 5358]
This rule may contain some elements that cannot be interpreted by current version of GPMC reporting module
Enabled
True
Program
System
Action
Allow
Security
Require authentication
Authorized computers
Protocol
6
Local port
Any
Remote port
5358
ICMP settings
Any
Local scope
Any
Remote scope
Any
Profile
All
Network interface type
All
Service
All programs and services
Group
Network Discovery
Network Discovery (NB-Datagram-Out)
Outbound rule for Network Discovery to allow NetBIOS Datagram transmission and reception. [UDP 138]
This rule may contain some elements that cannot be interpreted by current version of GPMC reporting module
Enabled
True
Program
System
Action
Allow
Security
Require authentication
Authorized computers
Protocol
17
Local port
Any
Remote port
138
ICMP settings
Any
Local scope
Any
Remote scope
Any
Profile
All
Network interface type
All
Service
All programs and services
Group
Network Discovery
Network Discovery (NB-Name-Out)
Outbound rule for Network Discovery to allow NetBIOS Name Resolution. [UDP 137]
This rule may contain some elements that cannot be interpreted by current version of GPMC reporting module
Enabled
True
Program
System
Action
Allow
Security
Require authentication
Authorized computers
Protocol
17
Local port
Any
Remote port
137
ICMP settings
Any
Local scope
Any
Remote scope
Any
Profile
All
Network interface type
All
Service
All programs and services
Group
Network Discovery
Network Discovery (UPnP-Out)
Outbound rule for Network Discovery to allow use of Universal Plug and Play. [TCP]
This rule may contain some elements that cannot be interpreted by current version of GPMC reporting module
Enabled
True
Program
System
Action
Allow
Security
Require authentication
Authorized computers
Protocol
6
Local port
Any
Remote port
Any
ICMP settings
Any
Local scope
Any
Remote scope
Any
Profile
All
Network interface type
All
Service
All programs and services
Group
Network Discovery
Connection Security Settingshide
Administrative Templateshide
Policy definitions (ADMX files) retrieved from the local machine.
Network/Link-Layer Topology Discoveryhide
Policy
Setting
Comment
Turn on Mapper I/O (LLTDIO) driver
Enabled
Allow operation while in domain
Enabled
Allow operation while in public network
Enabled
Prohibit operation while in private network
Enabled
Policy
Setting
Comment
Turn on Responder (RSPNDR) driver
Enabled
Allow operation while in domain
Enabled
Allow operation while in public network
Enabled
Prohibit operation while in private network
Enabled
User Configuration (Enabled)hide
No settings defined.

Hi,
To enable Network Discovery, we need to make sure that the following dependency services are started on clients:
DNS Client
Function Discovery Resource Publication
SSDP Discovery
UPnP Device Host
Regarding this point, the following article can be referred to for more information.
You cannot turn on Network Discovery in Network and Sharing Center in Windows Server 2008, Windows Server 2008 R2, or Windows Server 2012
http://support.microsoft.com/kb/2722035
We can use group policy to control these services.
Regarding this point, the following article can be referred to for more information.
How to use Group Policy to control Services
http://www.grouppolicy.biz/2010/08/how-to-use-group-policy-to-control-services/
Best regards,
Frank Shen

Network Discovery not displaying Computers for Directaccess clients

Hi I have working Directaccess connected client but cannot see computers in Network Discovery though after lag can connect to network shares if manually entered in windows explorer. I ran the Directaccess troubleshooting tool in debug mode. And see only
this alert from results:
Warning - default gateway :: for Teredo Tunneling Pseudo-Interface does not reply on ICMP Echo requests.
ipconfig /all shows this for teredo:
Tunnel adapter Teredo Tunneling Pseudo-Interface:
   Connection-specific DNS Suffix . :
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2001:0:4800:e1da:1c66:1912:94f1:c9fd(Preferred)
   Link-local IPv6 Address . . . . . : fe80::1c66:1912:94f1:c9fd%12(Preferred)
   Default Gateway . . . . . . . . . : ::
   DHCPv6 IAID . . . . . . . . . . . : 117440512
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1A-6F-F3-2E-04-0C-CE-D8-05-D2
   NetBIOS over Tcpip. . . . . . . . : Disabled
Any help appreciated. I see computers in Network Discovery when I'm on Domain Profile though Network Discovery is enabled for Public as well.

Yes, I know this is an old post, I’m trying to clean them up. Did you figure this out, if so how?
Did you add the SERVER into the DHCP administrators group?
Keep in mind that without DCHP, the server will only discovery itself and whatever is listed within the ARP cache.
BTW, Network Discovery is not all the useful as it does NOT perform a sing sweep.
http://www.enhansoft.com/

Enable Network Discovery GPO not taking effect

Hi
I've created a GPO to turn on Network Discovery on our company laptops as our AV server isn't able to discovery a number of clients for an update roll out. I've enabled the both "Turn on Mapper I/O (LLTDIO) driver" and "Turn on Responder (RSPNDR)
driver" in Computer Configuration > Policies > Administrative Templates > Network > Link-Layer Topology Discovery. I've set it to only apply to the Domain network. I then applied the policy to the OU containing the laptops and scoped it to
the default Authenticated Users group.
Group Policy Modeling shows that the policy is applying. However, Network Discovery is still turned off on laptops that should be applying it.
David

Hi David,
Please try the following steps to solve this issue:
You must also enable the LLTD Responder component on any computers that you want to appear on your Network Map.
Please add the following policy to this GPO:
Expand "Computer Configuration", "Windows Settings", "Security Settings", "Windows Firewall with Advanced Security", and then "Windows Firewall with Advanced Security - {policy you have open}".
Right-click on "Inbound Rules", and then click "New Rule".
In the Rule Wizard, on the Rule Type page, select "Predefined", and then select Network Discovery from the list.
Click Next.
On the Predefined Rules page, ensure that the check box is on each rule that is part of the Network Discovery group, and then click Next.
On the Action page, select "Allow the Connection", and then click Finish.
Regards,
Lany Zhang

Disable network browser on win 7 using a GPO

Computer Configuration -> Administrative Templates -> Network -> Link-Layer Topology Discovery and you can disable both LLTDIO & RSPNDR.

Hi,
I am trying to disable network browser on win 7 using a GPO. I am not able to get the settings, can some help me what ADMX I need and what setting to be disabled.
This topic first appeared in the Spiceworks Community

How can I keep lion from generating .DS_Store files on windows network partitions, but not disable it for all network partitions?

How can I keep lion from generating .DS_Store files on windows network partitions, but not disable it for all network partitions? I am fimilar with changing the setting for all network partitions(defaults write com.apple.desktopservices DSDontWriteNetworkStores true), but that is undesirable when I connect my laptop to my home network. A preferable solution would be where I could control the writing of these files based on disk format (NTFS vs HFS+).

Go to MacUpdate or CNET Downloads and search for ds_store. There are numerous utilities for preventing them from being transferred to Windows systems.

Script to disable Client for Microsoft Networks and File and Print Sharing for Microsoft Networks

Hi, I am trying to find a way of using a batch file or vbscript to disable Client for Microsoft Networks and File and Print Sharing for Microsoft Networks on a Network Interface Controller.
I've done some searching on the internet and I can see some suggestions to locate the Setting ID of the NIC and then remove the value from the "Bind" string under "HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Linkage" and "HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Linkage"
I tried this but it didn't seem to uncheck itself from the NIC properties under NCPA.cpl
Can someone help me?

http://social.msdn.microsoft.com/Forums/vstudio/en-US/b0407073-07bc-462b-9de9-7295be5fa183/disable-file-and-printer-sharing-for-mircorosoft-networks?forum=csharpgeneral
¯\_(ツ)_/¯

The partner transaction manager has disabled its support for remote/network transactions....When inserting during trigger in linked server

Hi All,
I am getting below error while inserting into Linked Server (sql2012) thru trigger from sql2008 ....However if i insert the same thru Store Procedure it is inserting successfully....MSDTC service is started on both sql server machines....also both machines
rebooted....but still i am facing this error.
OLE DB provider "SQLNCLI" for linked server "XXX.XXX.XXX.XX" returned message "The partner transaction manager has disabled its support for remote/network transactions.".
Msg 7391, Level 16, State 2, Procedure ins_test, Line 11
The operation could not be performed because OLE DB provider "SQLNCLI" for linked server "XXX.XXX.XXX.XX" was unable to begin a distributed transaction.
Could assist to resolve.
Regards
Shehzad

Hi SHzKhan,
According to your error message, we need to verify if you configure the MSDTC correctly, When you have more than one SQL Server involved in a Distributed Transaction, you need to make some changes to the default configuration of MSDTC for these distributed
transactions to succeed. There is a detail about recommending MSDTC settings for using Distributed Transactions in SQL Server, you can review the following article.
http://support.microsoft.com/kb/2027550/en-us
There is a similar issue about error 7391, you can refer to the following link.
http://dba.stackexchange.com/questions/30235/msg-7391-distributed-transactions-dtc-on-sql-server
Regards,
Sofiya Li
Sofiya Li
TechNet Community Support

How to disable network connections for an application

Hi to all,
I would like to know if there is any way a user can disable network connections for a specific application.
Thank you,
Xwang

Yes, but I would like to block only a specific application, not all the traffic from the PC.
I've found this "solution" which uses iptables on the net:
"Add a group to your system (I use nonet myself), then add a rule to your output chain like this: -A OUTPUT -m owner --gid-owner nonet -j REJECT --reject-with icmp-net-unreachable Run the program for which you know in advance that you want to block, with sg (sg nonet "your_prog your_args")."
Do you think is it right?
Another suggestion was to use unshare to call the program disabling the net for that program only.
The problem is that unshare is runnable only by root so, in case, I should turn on its setuid flag in order to execute the program as a normal user, but I don't know if it is safe to do that.
Last edited by Xwang (2014-10-11 08:06:16)

How to uncheck File and Printer Sharing for Microsoft Networks by Command!!

Dear everybody,
I meet a problem with my System now, and I need your help!!!
As mentioned in title, I need uncheck on File and Printer Sharing for Microsoft Networks by Command for Security purpose.
Could you show me the way to do it by command line
I think GPO can solve this but My Boss want to do it by command line
Thanks for your help!!!

netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
To disable these functions in Windows, use the same command and replace 'Yes' to 'No' in the above commands.

WIndows 7 and Server2008 machines will not remember network discovery preferences, requires setting every start up or wake up.

hello
I wondered if anybody here could be so kind as to help me solve this situation
i have two Windows 7 machines and Server2008 machines will not remember network discovery preferences,
i am running software on the windows server machine that collects data and serves information to two windows 7 machines, and network discovery is required for this purpose
these machines are configured in a local stand alone network configured as a workgroup the only other items on network are none PC based equipment that the server happily communicates with and reads data from
once the network discovery is set for the network the system runs as expected but on every start-up (or wake up) the network discovery is lost and need to be re allowed. this is the case in both windows server 20008 r2 and windows 7
how do i make these preferences permanent. so that it will restart and re establish communication its self without intervention
am i missing a setting or if not is there a way i can script the the selection of preference on each start(/wake)up.
the final user need to be able to turn system on/restart and use it with out having to have any IT/networking knowledge to get system running.
thank you for taking the time to read my query

You can use group policy to enable network discovery so that it is always configured
1. In the Group Policy editor on a Win7 or Windows Server 2008 R2 computer, open the GPO that you want
to use in the Group Policy Editor.
2. Expand "Computer Configuration", "Windows Settings", "Security Settings", "Windows Firewall with Advanced
Security", and then "Windows Firewall with Advanced Security - {policy you have open}".
3 Right-click "Inbound Rules", and then click "New Rule".
4 In the Rule Wizard, on the Rule Type page, select"Predefined", and then select Network Discovery from
the list. Click Next.
5 On the Predefined Rules page, ensure that the check box is on each rule that is part of the Network
Discovery group, and then click Next.
6 On the Action page, select "Allow the Connection", and then click Finish.

Same issue Network Discovery not working and Windows Update not working

I've read the threads.
This is a Vista Ultimate upgrade. My OOOOH My I have clocked 8 hours
Everything was working before. I tried all of the recommended services turning on restarting.
Also, ran into the problem of my memory being eaten. Suspected cause hibernate mode, which I had to disable. Scott Hasselman blog recommended the fix which is a cheap work around that limits machines functionality!!
I'm and IT Engineer specializing in MS product lines since Windows 1.0. MFC foundation classes etc.. What is the real problem ?
I don't have the NetBIOS over tcp/ip in my services?
I figure that the cost of my time and other individuals pays for the OS four times over. Give me a Microsoft developer subscription or something to make me happy. This is my development machine and I'm loosing time and money.
FYI, Just upgraded my second machine to Windows 8.1 OMG !!2 Hours to upgrade after the download. I loose my configuration settings. I required to have a Windows Live whatever account!!! This is not the way to compete and keep customers.
Windows XP has been by far the best deployment experience. I need a Knowledge base that gives solutions , not a troubleshooting scenario that does or does not work!!
Please , don't tell me to go and by a OEM Surface I cannot recommend this to my clients.
Thank You

Hi,
If it worked previously, a quick solution is to run System Restore and get back to the previous status when the issue didn’t occur.
What is System Restore?
http://windows.microsoft.com/en-us/windows7/What-is-System-Restore
When you turn on network discovery, do you get any error prompt?
Please check if you have any error message about network discovery in event viewer.
Open Event Viewer
http://windows.microsoft.com/en-US/windows7/Open-Event-Viewer
What information appears in event logs (Event Viewer)?
http://windows.microsoft.com/en-US/windows7/What-information-appears-in-event-logs-Event-Viewer
Please use Windows Live SkyDrive (http://www.skydrive.live.com/) to upload the Error logs to a public folder and share the URLs with us.
Also, please temporarily turn off your firewall and all the security programs for a test.
As far as I know, Network discovery requires that the DNS Client, DNS Client, Network Connections, Network Location Awareness, Remote Procedure Call (RPC), Function Discovery
Resource Publication, TCP/IP Netbios helper, SSDP Discovery, and UPnP Device Host services are started and set to automatic.
You should check again if you have started all these services.
Regarding the update issue, I suggest you try the following suggestions.
1. Temporarily disable firewall and antivirus program to test the issue.
2. Open the Windows Update troubleshooter
http://windows.microsoft.com/en-US/windows7/Open-the-Windows-Update-troubleshooter
3. Reset Windows Update components
http://support.microsoft.com/kb/971058
You may follow the steps from the link below to fix the issue.
Windows Update Not Working.
http://support.microsoft.com/kb/555989
You may also see the common Windows Updates troubleshooting guide.
Fix Microsoft Windows Update Issues
http://support.microsoft.com/kb/906602
Hope it helps.
Regards,
Blair Deng
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

GPO For Disable Network Discovery

Similar Messages

Maybe you are looking for