Question : How to setup a Group Policy (GP) in SBS2008 server to open some ports in Windows Firewall

 Can someone walk through the steps as how to setup a Group Policy in SBS2008:

1) The group policy should set an exception in windows firewall on all the client computers
in the network to open up 2 ports (5800,5900)

2) The group policy should set an exception in windows firewall on all the client computers
to give Remote Desktop access.


3) The group policy should set an exception in windows firewall on all the client computers
to enable "File and print Sharing"

Answer : How to setup a Group Policy (GP) in SBS2008 server to open some ports in Windows Firewall

Using the Group Policy Management Console: (Guide here) http://trycatch.be/blogs/roggenk/archive/2007/07/25/windows-server-2008-amp-group-policy-management-console-gpmc.aspx

Create a New GPO Name it, then Edit it. Navigate to Computer Configuration, Windows Settings, Security Settings, Windows Firewall with Advanced Security.

When you click on Windows Firewall with Advanced Security, a kind of applet will open in the right side window of the Group Policy. At the bottom, there are two entries, Inbound Rules and Outbound Rules.
Click on either one and you'll have an empty space in the right pane. Right click in the space and click New.

You'll get a wizard that will let you make new rules. For your 5800,5900 rule, select port, then click next. On the next screen select TCP and type 5800, 5900 in the "Specific Local Ports" entry. Click Next.
Select Allow the Connection. Click Next. Select where the rule should apply. The next page asks you if you want to apply this to Domain, Private, or Public networks. Domain means connected to your Business Lan, Private is for when a Laptop goes to someone's home, public is for when someone is connected to a Wireless hotspot out in the world somewhere. You can set this how you want, but I'd recommend keeping the checkbox only in the Domain box. Click next. Give the Rule a name (Like port 5800, 5900 allow). Click on Outbound rules in the left pane and do the same steps again to open outbound traffic.

For your Remote Desktop Access: Go to inbound again and create another New Rule. When the wizard comes up this time, select "Predefined" and select "Remote Desktop" from the list. Click Next, and then Next. And then select Allow the Connection and Finish. Again repeat this for the outbound rules.

For File and Print Sharing, Do the same thing as with Remote Desktop but this time Select "File and Printer Sharing" in the Predefined section on the wizard. Click next, next, then finish, and do the same again for the outbound rules.

Once all that is done, you can then close the Group Policy Editor and then Link the Group Policy to whichever part of your Domain you want it to apply to.

Let me know if you have any questions.