Configure SCCM Firewall Rules and Exceptions

In this post I will show you how to configure SCCM firewall rules and exceptions. Configuration Manager uses defined network ports and exceptions for client push that must be allowed in the firewall for the communication to occur.

Before you install the Configuration Manager in your site, it is important to understand what ports are utilized and what needs to be allowed in the firewall. The firewall rules and exceptions required for SCCM are not limited to clients but also include other components such as SQL Server, software update points, management points, and so on.

During my SCCM consulting, I frequently encounter issues such as client push installation failures, clients failing to retrieve policies from the management point, clients failing to download updates from SUP, and many others. All these issues occur due mostly to the firewall rules and exceptions that aren’t in place.

I have also seen many cases where a Windows Firewall is simply turned off on both Management Points and client computers. This is not a best practice for any organization and this puts both your SCCM servers and client computers at risk. A firewall protects your device and you should never turn it off or disable the service.

Firewall Ports used in SCCM

I have published a guide on Configuration Manager Firewall Ports that includes a list of all the firewall ports used in SCCM. To make it easier to understand, I have grouped the SCCM firewall ports according to the components, roles, and the direction in which they must be opened.

Configure Firewall for SCCM Client Push

The Client push installation method lets you install Configuration Manager clients on remote devices from the console. The client installation can fail if the client is running a firewall that is blocking the ports being used by the installation process.

To successfully use client push to install the Configuration Manager client, you must add the following exceptions to the Windows Firewall:

• File and Printer Sharing
• Windows Management Instrumentation (WMI)

Let’s go through the steps for creating a new SCCM firewall policy for client push to allow the above exceptions in the firewall.

Create Inbound Rule – File and Printer Sharing Service

We will create an inbound and outbound rule and add File and Printer Sharing Service as an exception in the firewall . Next, we will create an inbound rule to allow WMI. To create SCCM firewall rules, we will make use of group policy.

Sign in to the domain controller server and launch the Group Policy Management console. Expand the domain, right-click your domain and select Create a GPO in this domain and link it here.

Specify the GPO name as SCCM Client Push Policy. Click OK. Right-click the policy and select Edit.

In the Group Policy Management Editor, expand Computer Configuration > Windows Settings > Security Settings > Windows Firewall with Advanced Security. Right-click on the Inbound Rule and select New Rule.

On the Rule Type window, select Predefined rule and click the drop-down and select File and Printer Sharing. Click Next.

Select all rules for File and Printer Sharing and click Next.

Check the radio button Allow the Connection and click Finish.

Our inbound rule is now created.

Create Outbound Rule – File and Printer Sharing Service

Now we will create an outbound rule for the same.

Make sure all the rules are selected. Click Next.

Select Allow the Connection. Click Finish.

We have created a rule to allow the file and printer sharing outbound in Windows Firewall.

Create Inbound Rule – Windows Management Instrumentation

Now we will create an Inbound Rule to allow Windows Management Instrumentation in the firewall. Create an inbound rule selecting Windows Management Instrumentation from the predefined list of programs. Click Next.

Check all the WMI rules and click Next.

Allow the connection. Click Next. Specify the rule name for WMI exception and close the wizard.

Create SCCM Firewall Policy for SQL Ports

Next we will create an SCCM firewall policy for SQL ports. Basically, we will create a GPO to open TCP ports 1433 and 4022 for SQL replication via Windows Firewall.

By default, Microsoft Windows enables the Windows Firewall, which closes port 1433 to prevent Internet computers from connecting to a default instance of SQL Server on your computer. Connections to the default instance using TCP/IP are not possible unless you reopen port 1433.

Open the Group Policy Management console. Create a new policy and name it as SQL Ports for SCCM. Right-click the policy SQL Ports for SCCM GPO and click Edit.

In the Windows GP management console, expand Computer configuration, Windows settings, Security settings, and Windows Firewall with advanced security.

SQL Ports for SCCM – Open TCP Port 1433

In this step, we will create an inbound rule and add port 1433 to allow it through the firewall. Right-click Inbound Rules and select Create New Rule. On the Rule Type window, select rule type as ‘Port‘ and click Next.

Select TCP protocol and specify port number 1433 in specific local ports. Click Next.

In the Action tab, click Allow connection and click Next.

The firewall rule will be applied for all the 3 profiles. Click Next.

• Domain
• Private
• Public

Enter the rule name as TCP Inbound 1433 for identification. Click Finish.

SQL Ports for SCCM – Open TCP Port 4022

In this step, we will add an inbound rule to allow the TCP port 4022 in the firewall. Right-click Inbound Rules and select Create New Rule. Choose the Port from the list of options and click Next.

Choose the Protocol as TCP and specify the port number as 4022. Click Next.

Choose Allow the connection.

This rule applies to all 3 profiles; click Next.

Enter the rule name as TCP Inbound 4022 for identification. Click Finish.

The inbound rules that we created for SQL Server ports are now listed under the Inbound Rules section of the firewall. That’s all you need to configure as SCCM client push firewall ports and exceptions.