i am about to implement IPsec to achive a zero trust environment, in order to do so i am using the Windows Firewall with IPsec Rules (Allow the Connection if it is secure).
Everything works fine, but as soon as i add an user to "Remote Users"
to the inbound firewall rule for Port 135 RPC / DCOM for WMI usage, the Firewall drops the packets for a reason i dont unterstand yet.
i try to use the "Rename-Computer" powershell command to change the hostname of a remote-device, this command uses WMI and RPC to connect to the device.
Rename-Computer -Computername Computer1 -NewName Computer2 -DomainCredential Domain\Admin1
--> i started powershell from an allowed remote computer with an allowed remote user logged in.
--> other protocols with firewall rules configured the same way like SMB and C$ share are working fine and without problems from the same session
--> i can also connect with Computer Management remotely to the PC which uses aswell RPC Port 135 as far as i know
--> just when i use the powershell command, the firewall blocks the traffic.
--> when i remove the "Remote User" dependency on the FW-Rule, and only rely on "Remote Computer" instead, the traffic is passing the firewall (= the powershell command works)
--> in Powershell "whoami" confirms my identity which is an allowed "Remote User"
--> For testing purposes, i did create an inbound FW-Rule which allows ALL-Traffic for everything as long as "The Connection is Secure" and is coming from "RemoteComputerABC" and "RemoteUserABC": Same thing here, RPC Port 135 Blocked. But if i dont require a specific Remote User, and use only RemoteComputer segmenting, all works
--> if i use on the same remote session the powershell command below to test if port 135 is reachable with RemoteUser Segmenting active, it works
Test-NetConnection -ComputerName remotedevice -Port 135
UPDATE: POSSIBLE WORKAROUND: Use "Invoke-Command" to connect to the remote device and then run the rename-computer command localy on the remote machine. (you have to activate WinRM Service on remote machine for this)
