TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ----------------------------------------------------------------------------
We ran into this problem not only blocking remote administration but also centralized backups (which require their own admin rights). It is a BlackIce issue which we have reported to ISS who is working a fix. In the mean time, we have a "successful" work around. We found our problems with backups and remote administration went away when we turned off the default "block" response to the Nimbda Worm Propagation (HTTP_Nimbda_riched20dll)denial of service rule. ISS is researching why BlackIce is reacting with false positives in the foregoing situations. In the meantime, for the events kicked off by riched20.dll, our enabled responses are DISPLAY and LOGDB with the BLOCK response turned off. This fix doesn't come with all the warm fuzzies you may like but it will get your admins back in business until a patch comes along. If you want to get creative, I suppose you could enable the EMAIL or PAGE response and direct it to the sysadmin doing the remote administration. They could then make the call on whether the event was a false positive induce by their remote activity or the real deal. V/R, Doug ____________________________________________ Doug Maxham, CISSP Secure Infrastructure Services Telecommunication Services - NISSC 4200 Wake Forest Road Raleigh, NC 27668-9000 Office # 919.501.9219 FAX # 919.501.9180 Cell # 919.601.2218 "Delivering Trust In a Changing World" -----Original Message----- From: [EMAIL PROTECTED] at INTERNET Sent: Wednesday, March 20, 2002 12:20 PM To: Maxham, Douglas P - Raleigh,NC; Lassiter, Kenneth M - Raleigh,NC; Roberson, Kevin C - Raleigh,NC; Gilmore, Russell W; [EMAIL PROTECTED] at INTERNET Subject: Connectivity to Windows 2000 Servers with RS 6.5 Sensor TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ---------------------------------------------------------------------------- We are having connectivity issues to Windows 2000 servers with RS 6.5 Sensors installed. Members of the Domain Administrators group can not connect to the administrative shares, manage services, view event logs, etc. Members of the Local Administrators group work fine (If they also not members of Domain Admins). Is there anyone else having these issues?
