ICMP in Active Directory

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

Something I came across recently which I thought might be useful to some of you guys.

If you are implementing Active Directory in a secure environment such as a DMZ where the servers have firewalls between them, do not block ICMP between the servers, it breaks Group Policy updates amongst other things.

After locking down the environment in the project I've been working on for the last couple of months I started to see some real odd behaviour on the DC's and member servers. The DC's started reporting they couldnt see any domain controllers for the domain after being rebooted and the member servers were reporting event ID 1054

"[size=-1]Windows cannot obtain the domain controller name for your computer network. (<error description>). Group Policy processing aborted. "

The only refernce from Microsoft I could find talked about the size of the ICMP packets being limited, not if you were totally blocking them. I then came across a post on Neohapsis from a Microsoft representative

http://archives.neohapsis.com/archives/ntbugtraq/2003-q4/0031.html

If you're looking for more info on this particular problem do a Google search on "ICMP Ping and Group Policy Update"


[/size]

 

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

Used this when I had to put DC's in a DMZ - I tended to create a seperate forest for the DMZ thus creating a security boundary above layer 3

http://www.microsoft.com/downloads/...46-43f0-4caf-9767-a9166368434e&DisplayLang=en