Enable File and Printer Sharing using Group Policy

Group Policy is a one of the most useful tools found in the Windows 2000 and later Active Directory infrastructure. Group Policy can be used to set File and Printer Sharing on all computers joined to the domain. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. The following example uses Windows 2003 Server. The procedure for 2008 is almost exactly the same.

• Log on to your domain controller.
• Click Start, click Administrative Tools, and then click Active Directory Users and Computers.

Note
You need to determine what group of machines your policy is going to be applied to. Some organizations will have computers under many different OUs. The simplest method is to change the group policy for the entire domain.

• Right-click on the domain name and then click Properties
• Select the Group Policy tab
• Select the policy you want to edit (In our case it is the Default Domain Policy)
• Click edit.
• As this is a computer policy (It will apply to computers…not specific users), In the Group Policy Management Editor navigation pane, expand Computer Configuration, expand Administrative Templates, expand Network, expand Network Connections, and then expand Windows Firewall.

You will notice two sections under this area. A domain profile, and a standard profile. A machine will automatically determine which profile it should use by the type of network it is connected to. Microsoft defines it in this way:

• Domain profile The domain profile is the set of Windows Firewall settings that are needed when the computer is connected to the managed network. For example, the domain profile might contain settings for excepted traffic for the applications and services needed by a managed computer in an enterprise network.
• Standard profile The standard profile is the set of Windows Firewall settings that are needed when the computer is connected to another network. A good example is when an organization laptop computer is taken on the road and connects to the Internet using a public broadband or wireless Internet service provider. Because the organization laptop computer is directly connected to the Internet, the standard profile should contain more restrictive settings than the domain profile.

Note
For security reasons, you should only making these changes to the Domain Profile as you don’t want users outside the office to hookup to another network with their file and printer sharing fully accessible.

• Expand Domain Profile
• In the details pane, double-click Windows Firewall: Allow file and printer sharing exception
• On the Setting tab, click Enabled.
• In Allow unsolicited incoming messages from, type *. This value allows any computer to connect.
• Click OK to save your changes.

After configuring an important policy of some kind, we would sometimes like GP processing to occur immediately on client computers. The problem is that by default, the so called background processing “only” happens every 90 to 120 minutes (randomized) – if we want to force updates to occur right away we are on our own.

Allow some time (90 to 120 minutes) for the group policy processing to occur on client computers. To force updates to occur right away, you can go to the command line on the server and type:

GPUPDATE /force

To verify the policy is applied, go to a workstation and check the "Windows Firewall Settings" to see that it has accepted the policy.