NightWatchman Enterprise 7.3

Windows firewall settings

Windows Firewall Exceptions

By default WakeUp Server uses TCP and UDP ports 1776 to communicate to the 1E Agents when installed in one of the Agent modes. The 1E Agents use TCP and UDP port 1777 to communicate to the WakeUp Server.

By default windows Firewall restricts port access, so the ports must be re-opened at the server and at the client prior to using the 1E Agent. The following command-line opens the necessary ports for access:

> netsh firewall set portopening tcp 1776 1EWakeUpTCP
> netsh firewall set portopening udp 1776 1EWakeUpUDP
> netsh firewall set portopening tcp 1777 1EWakeUpTCP
> netsh firewall set portopening udp 1777 1EWakeUpUDP

This command-line should be run on every machine where an Agent is installed, a convenient way to do this is to create a Configuration Manager Package and Program with the above command line and advertise to all your 1E Agent machines.

You will also need to check that the ICMP 'incoming echo request' settings are enabled for ipV4. The methods depend whether the machine is running Windows XP SP2 or Windows Vista and later. These methods are outlined below. By default this rule will be enabled if the 'File and Print Sharing' rule has been enabled.

Windows Vista ICMP settings

The netsh command to create a rule to enable IPv4 'incoming echo request' for domain and standard profiles is

> netsh advfirewall firewall 
        add rule name="ICMPv4 Allow incoming echo request" 
        protocol=icmpv4:8,any dir=in action=allow

The chosen name is not critical. You can also restrict the scope of to and from addresses to all, localsubnet or specific IP addresses, using the remoteip switch. More information about firewall commands can be found at http://go.microsoft.com/fwlink/?linkid=111237.

To show all inbound rules, use

> netsh advfirewall firewall 
        show rule name=all dir=in 

To manually configure Windows Firewall on Vista to allow ICMP Ping you will need to add a new Inbound Rule in the Windows Firewall with Advanced Security Control Panel application. The diagram below shows the New Inbound Rule Wizard and a custom rule being created with the ICMPv4 protocol selected.

You will also need to choose the Echo Request type from the Customize ICMP Settings dialog, displayed when you click on the Customize... button. Refer to your Windows documentation for complete details on adding the Inbound Rule.

Problems with Intel® AMT functionality in Small Business mode

When the WakeUp Intel® AMT component has been installed in Small Business Mode the installer is unable to verify that the user credentials supplied have the appropriate permissions. If you encounter problems with this functionality after installation you should check the WakeUp Intel® AMT log file amtlog.log. If you see Connection Failed errors, the likely cause is insufficient permissions on the account.

WakeUp menu does not appear in Configuration Manager console after installation

If you install WakeUp with the Configuration Manager console open, the installation will complete successfully but the WakeUp option menu will not become available until the Configuration Manager console has been closed and restarted.

Policy Refresh does not cause faster software distributions

If this is the case, if the agent log file indicates that a policy refresh has occurred, but the software distribution still takes longer to start, then it is likely that the policy refresh occurred before the Configuration Manager Management Point was updated. This can occur when creating new advertisements for immediate distribution. The delay before a policy refresh is performed can be set at 1E Agent installation time using the DELAYCYCLESMSSECS installer command-line switch. Post installation, to increase the delay before a policy refresh is performed, update the following registry key:

HKLM\SOFTWARE\1E\WakeUpAgent\DelayCycleSMSSecs

This is set to 16 seconds by default.

No scheduled wakeups when Configuration Manager server is restored after downtime

If a Configuration Manager server is down for a period of around two hours, wakeups will not be sent for adverts that would have been scheduled in that time. Once the server is restored you are advised to use the WakeUp right-click context menu action to manually send any required wakeup. After you have completed the installation and initial configuration of NightWatchman, additional detailed configuration can be found in The NightWatchman Administrator's Guide.