Enabling Least Privilege Firewall Rules for Remote Computer Management

AZ-801 By islever Editorial Last updated

Secure Windows Server networking Troubleshoot Windows Server issues

Short answer

AC Enable COM+ Network Access (DCOM-In) for RPC transport and Windows Management Instrumentation (WMI-In) for data query access on Server2.

Question

Your network contains an Active Directory Domain Services (AD DS) domain. The domain contains two servers named Server1 and Server2 that run Windows
Server.
You need to ensure that you can use the Computer Management console to manage Server2. The solution must use the principle of least privilege.
Which two Windows Defender Firewall with Advanced Security rules should you enable on Server2? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
  1. the COM+ Network Access (DCOM-In) rule Correct Answer
  2. all the rules in the Remote Event Log Management group
  3. the Windows Management Instrumentation (WMI-In) rule Correct Answer
  4. the COM+ Remote Administration (DCOM-In) rule
  5. the Windows Management Instrumentation (DCOM-In) rule

Key Takeaways

Computer Management requires both DCOM transport (COM+ Network Access) and WMI data access (WMI-In); enabling broad groups violates least privilege.

Learn which two Windows Defender Firewall rules enable least-privilege remote management via Computer Management console using DCOM and WMI.

Common mistake: Selecting Option B (Remote Event Log Management) is common but wrong because it only covers logging, not the full scope of Computer Management, and violates least privilege by opening unnecessary ports.

Expert Analysis

The Computer Management console (compmgmt.msc) is a Microsoft Management Console (MMC) snap-in that manages remote systems by combining several management protocols. To function correctly, it requires both a transport mechanism for the RPC/DCOM session and an interface for querying system data.

First, the connection to the remote server relies on Distributed Component Object Model (DCOM). DCOM uses Remote Procedure Calls (RPC) for communication. The COM+ Network Access (DCOM-In) firewall rule is specifically designed to allow this traffic. Without this rule, the initial handshake to establish a session with Server2 fails entirely. This makes Option A a mandatory component of the solution.

Second, once the DCOM connection is established, the Computer Management console queries WMI (Windows Management Instrumentation) repositories to retrieve information about services, disks, users, and event logs. Therefore, the Windows Management Instrumentation (WMI-In) rule must be enabled to permit these inbound WMI requests. This makes Option C the second required component.

Regarding the principle of least privilege: While some comments suggest enabling all rules in the "Remote Event Log Management" group (Option B), this is excessive for general Computer Management tasks. The core functionality of compmgmt.msc depends on DCOM transport and WMI data retrieval. Options D and E are incorrect because there is no standard firewall rule named "Windows Management Instrumentation (DCOM-In)" or "COM+ Remote Administration (DCOM-In)" in the default Windows Firewall policy; the correct identifiers are "COM+ Network Access" and "WMI-In". Thus, A and C represent the precise, minimal set of rules needed.

Official Reference

https://learn.microsoft.com/en-us/windows-server/administration/server-manager/configure-remote-management-in-server-manager#to-configure-mmc-or-other-tool-remote-management-over-dcom

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked about remote management tools like Computer Management or Server Manager, identify the underlying protocols: DCOM for the connection session and WMI for the data payload. Select the specific firewall rules corresponding to these protocols rather than broad administrative groups to satisfy least privilege constraints.

Frequently Asked Questions

Why is Option B (Remote Event Log Management) incorrect?

While Event Log Management allows viewing logs, Computer Management also manages Services, Disks, and Users. Enabling only the Event Log group is insufficient for full management and opens more ports than necessary, violating least privilege.

What is the difference between COM+ Network Access and WMI-In?

COM+ Network Access (DCOM-In) handles the RPC transport layer, allowing the client to connect to the server. WMI-In handles the actual query traffic over that connection to retrieve system information.

More AZ-801 FAQ →

Community Votes

A
40%
B
30%
C
20%
E
10%

40% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 13 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 13

  1. xxxxx85xx 👍 19
    Correct Answers "verify that exceptions to the following firewall rules are enabled, and have not been disabled by Group Policy settings. If any are not enabled, go on to the next step. COM+ Network Access (DCOM-In) remote Event Log Management (NP-In) remote Event Log Management (RPC) remote Event Log Management (RPC-EPMAP)"
  2. syu31svc 👍 3
    AB as to what xxxxx85xx mentioned from https://learn.microsoft.com/en-us/windows-server/administration/server-manager/configure-remote-management-in-server-manager
  3. Krayzr 👍 2
    GROK thinks its A C The Correct Answer: A and C The minimum rules required are: A. COM+ Network Access (DCOM-In): Enables the DCOM connection to Server2. C. Windows Management Instrumentation (WMI-In): Allows WMI-based management tasks. Together, these rules enable the Computer Management console to connect to and manage Server2 effectively, covering most of its functionality (e.g., services, system info) without unnecessary permissions. If event log access were specifically required, additional rules might be considered, but the question’s general scope doesn’t demand it.
  4. ppardav 👍 2
    A&C A: COM+ Network Access (DCOM-In) ✔ Required for DCOM communications used by MMC remote tools. Without it, the RPC/DCOM connection can’t be established. C: Windows Management Instrumentation (WMI-In) ✔ Required for Computer Management to interact with system components remotely (services, disks, registry).
  5. tatendazw 👍 2
    Yes, https://social.technet.microsoft.com/Forums/en-US/35a04f4e-a784-450d-965d-09b0ecec6f5d/unable-to-connect-to-remote-log-event-viewer-firewall-off-user-member-of-log-reader-group?forum=winserverManagement
Show 8 more comments
  1. nefaxto 👍 2
    Correct https://learn.microsoft.com/en-us/windows-server/administration/server-manager/configure-remote-management-in-server-manager#to-configure-mmc-or-other-tool-remote-management-over-dcom
  2. rpeelen 👍 2
    Correct answer
  3. examtaker2026 👍 1
    Connecting to a remote machine using the Microsoft Management Console (MMC) snap-in for Computer Management (compmgmt.msc) relies directly on Windows Management Instrumentation (WMI) over remote procedure calls. Under the principle of least privilege, opening broad administration groups or full event log suites is excessive; the connection handshake specifically requires enabling Windows Management Instrumentation (DCOM-In) to allow the initial remote DCOM endpoint mapping/activation, alongside Windows Management Instrumentation (WMI-In) to permit inbound WMI traffic on the dynamically negotiated ports. The general COM+ rules (options A and D) govern separate application-layer component services and do not satisfy the specific WMI transport required for remote computer management.
  4. tmz84 👍 1
    Computer 'TEST-DC02' cannot be connected. Verify that the network path is correct, the computer is available on the network, and that the appropriate Windows Firewall rules are enabled on the target computer. To enable the appropriate Windows Firewall rules on the remote computer, open the Windows Firewall with Advanced Security snap-in and enable the following inbound rules: COM+ Network Access (DCOM-In) All rules in the Remote Event Log Management group You can also enable these rules by using Group Policy settings for Windows Firewall with Advanced Security. For servers that are running the Server Core installation option, run the Netsh AdvFirewall command, or the Windows PowerShell NetSecurity module.
  5. SDK76 👍 1
    C: Windows Management Instrumentation (WMI-In) E: Windows Management Instrumentation (DCOM-In) rule. E: Windows has a general "COM+ Network Access" rule (Option A), but that's like opening the gate for every truck in the city. Option E is the "Least Privilege" choice because it only opens the DCOM gate specifically for WMI traffic. No other DCOM-based services get through. C: Once the gate (DCOM) is open, the actual information—like your list of Services, Disk partitions, and Shared Folders—needs to flow through. This data is carried by the Windows Management Instrumentation (WMI) service.
  6. Gore 👍 1
    The error message you get in Computer Management console when trying to connect to a device that does not fulfill the network connectivity requirements states that the below firewall rules must be enabled: The COM+ Network Access (DCOM-In) rule All the rules in the Remote Event Log Management group
  7. BlackCat9588 👍 1
    Correct A. the COM+ Network Access (DCOM-In) rule Most Voted B. all the rules in the Remote Event Log Management group
  8. az01 👍 1
    Sounds correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to On-Prem VMs Forward Events to Azure Sentinel?

S-grade

What should you do first to implement JIT VM access for VM1?

S-grade

Which Groups Grant Least Privilege to Add a Windows Server 2022 DC?

S-grade

Where Can You Enable Microsoft Defender for Servers in Azure?

S-grade

← Back to AZ-801 Study Guide