Port needed

[hugomarinho]

Hi Doug,

I want to use BatchPatch between Internal LAN and DMZ. Which ports I need to open between these to VLAN and in what sense?

Thanks

[doug]

BatchPatch Ports For Enterprise Firewall ACLs

[doug]

Using BatchPatch With Windows Firewall

[hugomarinho]

Hi Doug,

Ok I need to open 135 and 445 but in what sense?

I need only thsi 2 ports for launch : Download, install + reboot?

Thanks

[doug]

Hi Hugo –

BatchPatch uses a combination of WMI and PsExec.

In order for PsExec to work on a target machine, the target machine has to have File and Printer sharing enabled, and ports 135 and 445 need to be open. You’ll need to make sure that the computer running BatchPatch is able to connect to the \targetComputeradmin$ share on the target computer.

For WMI if the firewall is a Windows Firewall, then you simply need to follow the instructions outlined here: Using BatchPatch With Windows Firewall

However, if it’s not a Windows Firewall, then it can be more complicated because WMI uses dynamic ports. While it is possible to set WMI to use a static port, this could be labor-intensive, and we have not tested BatchPatch under these conditions.

WMI Static Port configuration:

http://msdn.microsoft.com/en-us/library/windows/desktop/bb219447%28v=vs.85%29.aspx

DCERPC:

However, many firewalls have implemented DCE/RPC, which solves this problem and allows the use of dynamic ports for WMI/RPC:

https://en.wikipedia.org/wiki/DCE/RPC

http://wiki.wireshark.org/DCE/RPC

[Author]

Posts