title: Firewall Issues with Deploying Test Agent [Visual Studio Team Foundation Server 2015]
body: <p>I'm currently running into an issue that is occurs when my Visual Studio TFS Server deploys a test agent to a remote server. According to documentation:</p>
  
  <ul>
  <li>You will need a minimum of two machines - a target server or virtual
  machine to deploy to, and an agent machine that drives the
  deployment. [Check]</li>
  <li>You should use an agent machine that is in the same domain and
  network as the target server(s). Communication from the agent to Team
  Services or TFS is over HTTP/HTTPS, while communication from the
  agent to target server(s) is uses the WinRM protocol. [Partial Check
  Our TFS server is located on domain Awhile our target server is ondomain B.] </li>
  </ul>
  
  <p>This is according to the documentation for deploying ASP.NET apps to domain-joined machines using WinRM.</p>
  
  <p>To limit the scope closer to the actual issue I'm having is that the deploy process seems to fail once configuration begins for the test agent. More specifically TestAgentConfiguration.ps1 PowerShell script that is ran on the TFS Server when being deployed to the target server. The requirements for this specific script as described on the github page is:</p>
  
  <ul>
  <li>.NET 4.5 on Windows7 SP1 or Windows 2K8R2 [Check]</li>
  <li>Test machines should have PSRemoting enabled (run 'Enable-PSRemoting'
  on Windows Powershell) ###WinRM setup This task uses the Windows
  Remote Management (WinRM) to access domain-joined or workgroup,
  on-premises physical or virtual machines. [Check - This command seems
  to only run once the machine has the firewall turned off (after a
  reboot). Our domain group policy disables Windows Firewall by
  default, so when running the above PowerShell command it works.
  However, if we enable the firewall (which seems to fix my issue) for
  the initial configuration of the TestAgent then the command no longer
  works both with and without the firewall. This is only fixed once
  rebooting the server]</li>
  </ul>
  
  <p>We have followed documentation based off what is presented on the Support Additional Help pages. However, I'm still confused on why the working solution for this deployment process requires Windows Firewall to be enable for any part of the configuration as on the Pre-Requisites says "<strong>There is no inbound communication from Team Services or TFS to the agent, or from the target server to the agent. This means that you do not need to open any firewall ports on the agent machine, but you do need to open the WinRM port on the target server(s).</strong>"</p>
  
  <p>I'm under the impression that since our environment is on two separate domains (A &amp; B) where domain B trusts domain A there are some additional steps that are checked with the firewall. <strong>However</strong>, with the configuration step failing during deployment when the Firewall is disabled, it will pass with the Firewall Enabled. Any further consecutive runs/deployments with the Firewall <strong>then</strong> <strong>disabled</strong> still <strong>pass</strong> making the initial Firewall check useless. </p>
  
  <p>I have each step's "TestAgentConfig.log" described in the summary which is saved on the target server for each step in the attempts that I made, however due to my post I'm limited to a certain limit of characters.</p>
  
  <p>Summary:</p>
  
  <ol>
  <li>Fresh reboot of target server, kicked off a build with the Windows
  Firewall Turned Off --> Build Fails </li>
  <li>On that same server without a reboot, <strong>turned on</strong> Windows Firewall
  --> Build Successful</li>
  <li>On that same server without a reboot, <strong>turned off</strong> Windows
  Firewall --> Build Successful</li>
  </ol>