Batchpatch ports for enterprise firewall ACLs

[doug]

Hey jagablack – I’m really glad to hear you like the tool!

BatchPatch port requirements are as follows:

Remote connections are established in a couple different ways, depending on the action selected in the software. Most of the Windows Update and Remote Patch/Software/Script Deployment actions use PsExec in one way or another plus remote fileshare access. These will generally require ports 135 and 445. The reboot, shutdown, and most “Get Information” actions use WMI, which has different and more complicated port requirements explained below. However, you’ll also notice that there are alternate reboot and shutdown methods in BatchPatch, which use a shutdown.exe instead of WMI. In these cases shutdown.exe is initiated with PsExec and so has the same port requirements of 135 and 445 mentioned above.

With regard to WMI, it uses dynamic ports, which makes it more difficult to setup proper ACLs in an enterprise firewall. There are lots of articles about WMI ports on the web and Microsoft’s site, so feel free to take a look around at some of those for more info. It is theoretically possible to set static WMI ports, but in practice I’m not sure this is ever really feasible, and we also haven’t tested it at the time of this writing. See here for more info: http://msdn.microsoft.com/en-us/library/windows/desktop/bb219447%28v=vs.85%29.aspx

Hope this helps.

-Doug

[jagablack]

Thanks Doug! Very timely help. I have forwarded this information on to my network engineer, I hope he is able to accommodate at some point soon.

In the meantime, I will use my workaround.

In regards to the WMI port issue, see this article… it suggests that if you use Dynamic RPC filters (stateful management), it can address the issue without reconfiguration of all your endpoints.

http://pberblog.com/post/2011/05/18/Dynamic-RPC-filters-%28DCERPC%29-and-firewalls.aspx

[doug]

Thanks for sharing. That’s very helpful.

-Doug

[doug]

More on BatchPatch port requirements here: BatchPatch Port Requirements

[Author]

Posts