Server 服务:防火墙状态

Microsoft.Windows.FileServices.Service.SMB.6.3.FirewallPortConfig (UnitMonitor)

此对象可监视文件和打印机共享的防火墙入站规则，并在规则被禁用或相应的 TCP 端口被阻止时生成警报。

Knowledge Base article:

摘要

此对象可监视文件和打印机共享的防火墙入站规则，并在规则被禁用或相应的 TCP 端口 445 和 139 被阻止时生成警报。

原因

出于以下原因，此监视器可能会进入“严重”运行状况状态：

Windows 防火墙未运行。
用于 TCP 端口 445 或 139 的文件和打印机共享的防火墙规则被禁用。

如果运行状况状态未知，则说明对此对象的监视尚未开始。

解决方案

确定是否已启用 Windows 防火墙

若要确定 Windows 防火墙是否已启用，请使用以下过程：

1. 在受影响服务器的提升命令提示符处，键入：sc query mpssvc，并按 ENTER。

2. 如果防火墙未运行，请键入以下命令：net start mpssvc。

确定是否已启用端口防火墙规则

若要确定是否已启用端口的防火墙规则，请使用以下过程：

1. 在受影响的服务器上打开“控制面板”，单击“系统和安全”，然后单击“Windows 防火墙”。

2. 在左侧窗格中，单击“高级设置”，然后单击“入站规则”。

3. 检查以下规则是否已启用以及“操作”是否设置为“允许”：

文件和打印机共享 (NB-Session-In)
文件和打印机共享 (SMB-In)

4. 如果防火墙规则未启用，请单击规则，然后在“操作”菜单中单击“启用规则”。

问题解决后该监视器将自动重置为正常状态。

Element properties:

Target

Microsoft.Windows.FileServices.Service.SMB.6.3

Parent Monitor

System.Health.AvailabilityState

Category

Custom

Enabled

True

Alert Generate

True

Alert Severity

Error

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.Windows.TimedScript.TwoStateMonitorType

Remotable

True

Accessibility

Public

Alert Message

Server 服务:文件和打印机共享端口已阻止

Windows 防火墙被禁用，或 TCP 端口 445 或 139 的防火墙入站规则被禁用。

RunAs

Microsoft.Windows.FileServices.MonitoringAccount

Source Code:

<UnitMonitor ID="Microsoft.Windows.FileServices.Service.SMB.6.3.FirewallPortConfig" Accessibility="Public" Enabled="true" Target="Microsoft.Windows.FileServices.Service.SMB.6.3" ParentMonitorID="SystemHealth!System.Health.AvailabilityState" Remotable="true" Priority="Normal" RunAs="FileServices!Microsoft.Windows.FileServices.MonitoringAccount" TypeID="Windows!Microsoft.Windows.TimedScript.TwoStateMonitorType" ConfirmDelivery="false">

  <Category>Custom</Category>

  <AlertSettings AlertMessage="Microsoft.Windows.FileServices.Service.SMB.6.3.FirewallPortConfig.AlertMessage">

    <AlertOnState>Error</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Error</AlertSeverity>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="Error" MonitorTypeStateID="Error" HealthState="Error"/>

    <OperationalState ID="Success" MonitorTypeStateID="Success" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <IntervalSeconds>30</IntervalSeconds>

    <SyncTime/>

    <ScriptName>CheckFirewallPort.vbs</ScriptName>

    <Arguments>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</Arguments>

    <ScriptBody><Script>

Option Explicit



SetLocale("en-us")



Dim oArgs

Dim serverName



Set oArgs = WScript.Arguments

If oArgs.Count &lt; 1 Then

    Wscript.Quit -1

Else

    serverName = oArgs(0)        

End If



' NET_FW_PROFILE_TYPE2

Const NET_FW_PROFILE2_DOMAIN    = &amp;h0001

Const NET_FW_PROFILE2_PRIVATE   = &amp;h0002

Const NET_FW_PROFILE2_PUBLIC    = &amp;h0004

Const NET_FW_IP_PROTOCOL_TCP    = &amp;h0006



' Create the FwPolicy2 object

Dim fwPolicy2

Set fwPolicy2 = CreateObject("HNetCfg.FwPolicy2")



Dim fwCurrentProfile, fwCheckProfile 

fwCurrentProfile = fwPolicy2.CurrentProfileTypes

fwCheckProfile = fwCurrentProfile And (NET_FW_PROFILE2_DOMAIN Or NET_FW_PROFILE2_PRIVATE)



Dim fwFileSharingPortsEnabled 

fwFileSharingPortsEnabled ="False"



Dim rule

For Each rule in fwPolicy2.Rules

    If (rule.Protocol = NET_FW_IP_PROTOCOL_TCP) And (rule.LocalPorts = "445") Then      

        If (Not rule.Enabled) And (rule.Profiles And fwCheckProfile )  Then

            fwFileSharingPortsEnabled = "True"

            Exit For

        End If

    End If

Next



Dim regularShareExist, objWMIService, colShares, objShare

regularShareExist = "False"



Set objWMIService = GetObject("winmgmts:" _

    &amp; "{impersonationLevel=impersonate}!\\" &amp; serverName &amp; "\root\microsoft\windows\smb")

Set colShares = objWMIService.ExecQuery("Select * from MSFT_SmbShare")

For each objShare in colShares

    If objShare.Special = "False" Then

	    regularShareExist = "True"

	    Exit For

    End If

Next



Dim portStatus

portStatus = "Disabled"



' Only if regular share exists and port 139/445 are not open will portStatus be returned as "Disabled"

If fwFileSharingPortsEnabled = "True" Then

	portStatus = "Enabled"

Else	

	If regularShareExist = "False" Then

	    portStatus = "Enabled"		

    End If

End If



Dim oAPI, oBag



Set oAPI = CreateObject("MOM.ScriptAPI")

Set oBag = oAPI.CreatePropertyBag()



Call oBag.AddValue ("PortStatus", portStatus)

Call oAPI.Return(oBag)



</Script></ScriptBody>

    <TimeoutSeconds>300</TimeoutSeconds>

    <ErrorExpression>

      <SimpleExpression>

        <ValueExpression>

          <XPathQuery Type="String">Property[@Name='PortStatus']</XPathQuery>

        </ValueExpression>

        <Operator>NotEqual</Operator>

        <ValueExpression>

          <Value Type="String">Enabled</Value>

        </ValueExpression>

      </SimpleExpression>

    </ErrorExpression>

    <SuccessExpression>

      <SimpleExpression>

        <ValueExpression>

          <XPathQuery Type="String">Property[@Name='PortStatus']</XPathQuery>

        </ValueExpression>

        <Operator>Equal</Operator>

        <ValueExpression>

          <Value Type="String">Enabled</Value>

        </ValueExpression>

      </SimpleExpression>

    </SuccessExpression>

  </Configuration>

</UnitMonitor>