---
locale: "en"
updated_at: "2025-10-27T11:15:35.699Z"
canonical: "https://www.isdecisions.com/en/userlock/docs/guides/installation/advanced/enforce-firewall-requirements"
---

# Enforce firewall requirements

Open required ports for UserLock communication.

> **📘 Useful resource**
>
> For the full list of protocols, ports, and communication flows used by UserLock, see [Communication and required protocols](/userlock/docs/reference/modules/communication-protocols).

## Overview

UserLock requires specific Windows Firewall rules to ensure reliable communication between the **UserLock server** and **protected workstations or terminal servers**.

You can configure these rules:

- **Individually**, on each machine (useful for tests or small setups)
- **Centrally**, through **Group Policy Objects (GPOs)** (recommended for large environments)

> **Important**
>
> Before proceeding, ensure that the **UserLock service **[impersonation account](/userlock/docs/reference/server-settings/service#service-impersonation) has administrative rights on all protected computers.

## 1. Configure the File and Printer Sharing on a single computer

File and Printer Sharing rules allow the UserLock server to communicate with workstations and deploy desktop agents.

1. Open **Windows Defender Firewall with Advanced Security**.
2. In the left pane, select **Inbound Rules**, then click **New Rule...**
3. Choose **Predefined** → **File and Printer Sharing** → **Next**.
  ![](https://a.storyblok.com/f/122374/709x580/3e46b09858/1-file-printer-sharing.png)
4. Select and enable the following rules:
  - File and Printer Sharing (Echo Request – ICMPv4-In)
  - File and Printer Sharing (Echo Request – ICMPv6-In)
  - File and Printer Sharing (SMB-In)
  ![](https://a.storyblok.com/f/122374/711x577/65b5df1f42/2-predefined-rules.png)
5. Click **Finish**.
  ![](https://a.storyblok.com/f/122374/703x571/b98cb52993/3-allow-connection.png)

## 2. Restrict access between server and workstations

For enhanced security, limit File and Printer Sharing and Remote Registry access so that communication occurs **only** between the UserLock server and protected computers.

### 

1. Open the **Properties** of each previously created rule.
2. Go to the **Scope** tab.
3. Define allowed IP addresses as follows:

#### On the UserLock server:

- **Local IP address:** Add the IP(s) of the UserLock server(s).
- **Remote IP address:** Add the subnet or IP range of the protected machines.

![](https://a.storyblok.com/f/122374/438x581/5f7ad60fb4/14-userlock-ip-address.png)

#### On the protected machines:

- **Local IP address:** Add the subnet or IP range of the workstations.
- **Remote IP address:** Add the IP(s) of the UserLock server(s).

![](https://a.storyblok.com/f/122374/426x578/9b59609cbe/15-userlock-ip-address.png)

> **Example**
>
> If all workstations use `10.3.1.1/255`, set that as the IP range on both sides.

## 3. Configure the Firewall Rules with Group Policy

For larger environments, deploy firewall rules through Group Policy to ensure consistency across all machines.

You’ll need two separate GPOs:

- One for **UserLock server(s)**
- One for **protected machines**

### Step 1. Create and edit the GPOs

1. Open the **Group Policy Management Console (GPMC)**.
2. Create or edit a GPO for each scope (UserLock server or workstations).
3. Navigate to:
`Computer Configuration → Policies → Windows Settings → Security Settings → Windows Defender Firewall with Advanced Security → Inbound Rules`
4. Right-click **Inbound Rules** → **New Rule...**
5. Follow the wizard to recreate all required rules (File and Printer Sharing, Remote Registry, etc.) as described above.

![](https://a.storyblok.com/f/122374/754x624/9f64e4fc91/16-gpo.png)

### Step 2. Apply the GPO to the UserLock server

1. Link the GPO to the **Organizational Unit (OU)** containing your UserLock server(s).
2. Configure inbound rules to **allow connections from the IP range** of the protected machines.

![](https://a.storyblok.com/f/122374/1175x481/39293a6c5c/17-gpo.png)

### Step 3. Apply the GPO to the protected machines

1. Link the GPO to the **OU** containing your protected computers.
2. Configure inbound rules to **allow connections from the UserLock server IP(s)**.

![](https://a.storyblok.com/f/122374/1177x471/79b98c86e5/18-gpo.png)

## Recommendations

- **Document** all IP ranges to prevent accidental exposure.
- **Verify** that GPOs are applied correctly using `gpresult /r` or `rsop.msc`.
- **Test connectivity** between the UserLock server and a sample workstation using:
  - `ping` (ICMP) for network reachability
  - `\\ServerName` (SMB) for file sharing validation

## Next step

💡 Once the firewall rules are configured, you can verify that all required communications are working correctly by following the guide [Check services and network protocols requirements](/userlock/docs/guides/installation/advanced/check-services-and-network-protocols-requirements).