SCAP templates fail with Vista endpoint managed by proxy (NETIQKB72145)

  • 7772145
  • 12-Mar-2010
  • 17-Mar-2010

Environment

Netiq Secure Configuration Manager 5.8

Situation

SCAP templates fails with Vista endpoint managed by proxy
Error when running FDCC template against a proxied VISTA endpoint. Error: "Unable to connect or authenticate"

Resolution

Use the instructions below to configure the proxied VISTA machine.

FDCC VISTA agentless scan as a member of a domain
-------------------------------------------------
-     Turn on remote registry service
-     Open the Local Security Policy MMC Snapin and configure the following
inbound firewall rule for TCP port 445. 
-     Navigate to \Security Settings\Windows Firewall with Advanced
Security\Windows Firewall with Advanced Security - Local Group Policy
Object\Inbound Rules\  
-     Right click and select "New Rule".  
-     Select "Predefined"
-     Select "File and Printer Sharing" from the drop-down list then click
the "Next" button. 
-     Check "File and Printer Sharing (SMB-In)" for profiles "Private,
Public" and "Domain".  
-     Click the "Next" button. 
-     Reboot to force the settings.


FDCC VISTA agentless scan as a standalone workstation
-----------------------------------------------------
-     Turn on remote registry service
-     Use regedt32.exe to add:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system
\
            Create DWORD value named:  LocalAccountTokenFilterPolicy With
value: 1
-     Open the Local Security Policy MMC Snapin and configure the following
inbound firewall rule for TCP port 445. 
-     Navigate to \Security Settings\Windows Firewall with Advanced
Security\Windows Firewall with Advanced Security - Local Group Policy
Object\Inbound Rules\  
-     Right click and select "New Rule".  
-     Select "Predefined"
-     Select "File and Printer Sharing" from the drop-down list then click
the "Next" button. 
-     Check "File and Printer Sharing (SMB-In)" for profiles "Private,
Public" and "Domain".  
-     Click the "Next" button. 
-     Reboot to force the settings.

Cause

This is a configuration issue.

Additional Information

Formerly known as NETIQKB72145