Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Windows 2008 R2 server which is to contain sensitive documents on a small LAN. The two users who use the server do so via RDP so no documents are transferred to client workstations. During a due diligence operation, I determined that numerous services and scheduled tasks built into Windows can phone home and potentially leak data.

I would like to prevent any of these built in services from doing so if possible at a server level.

I do not have control of the firewall on the LAN unfortunately as it's a canned remotely maintained one with a lengthy contract. Control of this would be no use either as outbound HTTP is required for two RDP users on the machine.

Patches are pushed to the machine via PowerShell from a workstation. Windows update is turned off already.

I have considered Windows Firewall but I do not 100% trust its configuration tooling and I know that some services can add exceptions to the rules at runtime.

What solutions are there available to resolve this problem and is there any documentation on what potentially goes over the wire or is this a reverse engineering job?

Any help appreciated!

share|improve this question
If you don't trust Microsoft and/or their operating system, you shouldn't use it. That being said, if you don't have any control over the network the machine is connected to, your best bet might be something like NetLimiter which enables fine-grained control over which processes can connect to the internet. – Oliver Salzburg Jun 7 '13 at 19:27
Thanks for your reply. I'm a Linux guy who has unfortunately inherited this. I'd switch it over in a heartbeat, but there are two specialist applications that run only on IIS + SQL Server. Will take a look at NetLimiter. – Chris Smith Jun 7 '13 at 19:30
There might be more "professional" solutions to a problem like this, but I really only have experience with NL. I would have suggested the Windows firewall otherwise, but your concerns regarding services adding exceptions are founded. If something like this is actually happening, I can't say. The only "phoning home" I'm aware of is Windows Error Reporting and the Windows Customer Experience Improvement Program (both of which can be disabled easily). If anything else is happening beyond that, I don't know. – Oliver Salzburg Jun 7 '13 at 19:35
up vote 3 down vote accepted

The simplest way to do this is do this through Group Policy. Using Group Policy you can set non-overrideable firewall rules to block all outgoing connections unless they are added on a explicit allow list that only Domain Administrator users can add to. If all the software on the server is running as Local Administrator or lower they can't override the Group Policy rules (and even if they did get a way to change it, reviewing the resultant firewall rules is something that is very easy to audit on Windows).

If you need more information on how to set up firewall rules via group policy I can try and add more information.

I said that is the easiest way, there are more fine grained controls where you can turn off each of the windows specific features that use internet access.

share|improve this answer
Thanks for this. I was unaware you could manage firewall rules with group policy. I've found a TechNet article which appears to cover it: – Chris Smith Jun 7 '13 at 19:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .