WMI traffic through ISA 2006

Question

Hello,
I am having a problem in my network and read this in an article to solve the problem:
    Allow the following traffic in your ISA Server:
TCP/IP - port 135 - RPC/DCOM/WMI endpoint mapper (RpcSs)
TCP/IP - all ports - Asynchronous callback WMI client (Unsecapp)
TCP/IP - all ports - Windows Management Instrumentation service (Wmimgmt)
(It is taken from this article: http://support2.microsoft.com/kb/2737560)
It is easy to make the first one, port 135, but the other two rules, if those two are "all ports" , what is the difference? How could do that in ISA ? . Sorry if it is too basic a question.
Luis Olías Técnico/Admon Sistemas . Sevilla (España - Spain)

Answer 1

Hi,
Did you enable the inbound rules below?
Windows Management Instrumentation (WMI-In)
Windows Management Instrumentation (DCOM-In)
Windows Management Instrumentation (Async-In)
 Please see the figure below:
If you have enabled those rules and the issue persists, please run the commands below in command prompt:
netsh advfirewall firewall add rule dir=in name="DCOM" program=%systemroot%\system32\svchost.exe service=rpcss action=allow protocol=TCP localport=135
netsh advfirewall firewall add rule dir=in name ="UnsecApp" program=%systemroot%\system32\wbem\unsecapp.exe action=allow protocol=TCP localport=any
netsh advfirewall firewall add rule dir=in name ="WMI" program=%systemroot%\system32\svchost.exe service=winmgmt action = allow protocol=TCP localport=any
netsh advfirewall firewall add rule dir=out name ="WMI_OUT" program=%systemroot%\system32\svchost.exe service=winmgmt action=allow protocol=TCP localport=any
Best regards,
Susie