一、簡介
公司主機加入域后，防火牆未進行設置，規則不統一，不少主機ping不通。另打算開啟遠程桌面，方便遠程管理網內每台主機。曾在DC上測試過域組策略內的Windows防火牆設置，無論是新增規則還是直接開啟允許ICMP之類的選項，Win7客戶端都無效，最后不得不考慮批處理。批處理執行方式和前文的相同，域組策略在用戶開機時自動執行。
二、配置
1、防火牆
net start MpsSvc ::開啟服務
sc config MpsSvc start= auto ::開機啟動 netsh advfirewall set allprofiles state on ::啟用防火牆 netsh advfirewall firewall add rule name="Allow Ping" dir=in protocol=icmpv4 action=allow netsh advfirewall firewall add rule name="FTP" protocol=TCP dir=in localport=20 action=allow netsh advfirewall firewall add rule name="FTP" protocol=TCP dir=in localport=21 action=allow netsh advfirewall firewall add rule name="SSH" protocol=TCP dir=in localport=22 action=allow netsh advfirewall firewall add rule name="Telnet" protocol=TCP dir=in localport=23 action=allow netsh advfirewall firewall add rule name="SMTP" protocol=TCP dir=in localport=25 action=allow netsh advfirewall firewall add rule name="TFTP" protocol=UDP dir=in localport=69 action=allow netsh advfirewall firewall add rule name="POP3" protocol=TCP dir=in localport=110 action=allow netsh advfirewall firewall add rule name="HTTPS" protocol=TCP dir=in localport=443 action=allow netsh advfirewall firewall add rule name="Netbios-ns" protocol=UDP dir=in localport=137 action=allow netsh advfirewall firewall add rule name="Netbios-dgm" protocol=UDP dir=in localport=138 action=allow netsh advfirewall firewall add rule name="Netbios-ssn" protocol=TCP dir=in localport=139 action=allow netsh advfirewall firewall add rule name="Netbios-ds" protocol=TCP dir=in localport=445 action=allow netsh advfirewall firewall add rule name="HTTP" protocol=TCP dir=in localport=80 action=allow netsh advfirewall firewall add rule name="HTTP" protocol=TCP dir=in localport=8080 action=allow
::常用端口
舊版語法（Win7&Win8.1測試無效）
@echo off netsh firewall set opmode mode = enable ::啟用防火牆 netsh firewall set icmpsetting type=ALL mode=enable
::允許ICMP
netsh firewall set service remotedesktop enable netsh firewall set portopening tcp 3389 enable
2、遠程桌面
@echo off net start SessionEnv net start TermService ::開啟服務 sc config SessionEnv start= demand sc config TermService start= demand ::開機手動啟動 REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f ::開啟選項
netsh advfirewall firewall add rule name="Remote Desktop" protocol=TCP dir=in localport=3389 action=allow
::開啟3389端口
本文出自 “運維菜鳥.log” 博客，謝絕轉載！