i am about to implement IPsec to achive a zero trust environment, in order to do so i am using the Windows Firewall with IPsec Rules (Allow the Connection if it is secure). IPsec

Everything works fine, but as soon as i add an user to "Remote Users" remote users

to the inbound firewall rule for Port 135 RPC / DCOM for WMI usage, the Firewall drops the packets for a reason i dont unterstand yet.

i try to use the "Rename-Computer" powershell command to change the hostname of a remote-device, this command uses WMI and RPC to connect to the device.

Rename-Computer -Computername Computer1 -NewName Computer2 -DomainCredential Domain\Admin1

--> i started powershell from an allowed remote computer with an allowed remote user logged in.

--> other protocols with firewall rules configured the same way like SMB and C$ share are working fine and without problems from the same session

--> i can also connect with Computer Management remotely to the PC which uses aswell RPC Port 135 as far as i know

--> just when i use the powershell command, the firewall blocks the traffic.

--> when i remove the "Remote User" dependency on the FW-Rule, and only rely on "Remote Computer" instead, the traffic is passing the firewall (= the powershell command works)

--> in Powershell "whoami" confirms my identity which is an allowed "Remote User"

--> For testing purposes, i did create an inbound FW-Rule which allows ALL-Traffic for everything as long as "The Connection is Secure" and is coming from "RemoteComputerABC" and "RemoteUserABC": Same thing here, RPC Port 135 Blocked. But if i dont require a specific Remote User, and use only RemoteComputer segmenting, all works

--> if i use on the same remote session the powershell command below to test if port 135 is reachable with RemoteUser Segmenting active, it works

Test-NetConnection -ComputerName remotedevice -Port 135

UPDATE: POSSIBLE WORKAROUND: Use "Invoke-Command" to connect to the remote device and then run the rename-computer command localy on the remote machine. (you have to activate WinRM Service on remote machine for this)


You must log in to answer this question.

Browse other questions tagged .