Server Fault Asked by InterLinked on November 4, 2021
I do IT work for an organization that is currently setting up (or letting me set up) an Active Directory domain. Right now, it’s still in testing with 1 DC and 1 client. A week or two ago, our switch alerted us to excessive traffic between the domain controller and the domain-joined machine. It reported it as "Windows file sharing", which seemed a bit much. The data was on the order of 30 to 40 GB per week, which didn’t make any sense since these were test machines and idle most of the time.
We confirmed today the traffic was all on port 445. I ran Wireshark on the domain-joined computer and immediately noticed that a specific Group Policy path was appearing in ~90% of the packets. The policy had the same GUID, and I used GPMC to trace the GUID to a Allow PowerShell Remoting
GPO I had set up a couple weeks previously to, well, allow PowerShell remoting.
All this GPO does is what it sounds like – open the necessary ports on each machine for remoting and allowing incoming connections as described in the documentation so that PS remoting works. I disabled the GPO just now, but just in the past couple hours it resulted in ~4 GB of traffic between the DC and the client. Could this be "normal" for any reason? Why would PS-Remoting be using this much bandwidth, and how might it be fixed?
Here is an HTML report of the GPO generated in PowerShell – formatting below is not great but it’s too large to screenshot:
Computer Configuration (Enabled)
Policies
Windows Settings
Scripts
Startup
For this GPO, Script order: Not configured
Name Parameters
netsh.bat
Security Settings
System Services
Windows Remote Management (WS-Management) (Startup Mode: Automatic)
Permissions
No permissions specified
Auditing
No auditing specified
Windows Firewall with Advanced Security
Global Settings
Policy Setting
Policy version 2.10
Disable stateful FTP Not Configured
Disable stateful PPTP Not Configured
IPsec exempt Not Configured
IPsec through NAT Not Configured
Preshared key encoding Not Configured
SA idle time Not Configured
Strong CRL check Not Configured
Inbound Rules
Name Description
Windows Remote Management - Compatibility Mode (HTTP-In) Compatibility mode inbound rule for Windows Remote Management via WS-Management. [TCP 80]
This rule may contain some elements that cannot be interpreted by current version of GPMC reporting module
Enabled True
Program System
Action Allow
Security Require authentication
Authorized computers
Authorized users
Protocol 6
Local port 80
Remote port Any
ICMP settings Any
Local scope Any
Remote scope Any
Profile All
Network interface type All
Service All programs and services
Allow edge traversal False
Group Windows Remote Management
Windows Remote Management (HTTP-In) Inbound rule for Windows Remote Management via WS-Management. [TCP 5985]
This rule may contain some elements that cannot be interpreted by current version of GPMC reporting module
Enabled True
Program System
Action Allow
Security Require authentication
Authorized computers
Authorized users
Protocol 6
Local port 5985
Remote port Any
ICMP settings Any
Local scope Any
Remote scope Any
Profile All
Network interface type All
Service All programs and services
Allow edge traversal False
Group Windows Remote Management
Connection Security Settings
Administrative Templates
Policy definitions (ADMX files) retrieved from the local machine.
Windows Components/Windows Remote Management (WinRM)/WinRM Service
Policy Setting Comment
Allow remote server management through WinRM Enabled
IPv4 filter: *
IPv6 filter:
Syntax:
Type "*" to allow messages from any IP address, or leave the
field empty to listen on no IP address. You can specify one
or more ranges of IP addresses.
Example IPv4 filters:
2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22
*
Example IPv6 filters:
3FFE:FFFF:7654:FEDA:1245:BA98:0000:0000-3FFE:FFFF:7654:FEDA:1245:BA98:3210:4562
*
User Configuration (Enabled)
No settings defined.
Get help from others!
Recent Questions
Recent Answers
© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP