Most efficient way to remove default gateway from multiple PCs?

[Lateralus]

I want to be able to remove the default gateway from approx. 80 Windows 2000 workstations without visiting each one.

AFAIK there is no way to do this via group policy, at least not that I could find.

I'd love to be able to do it remotely via the netsh command, but I could not get the username and password commands to work. I am doing this FROM a Windows 7 machine, if that makes a difference in how the command is used. I hit a road block trying to do it remotely with the -r option, so for right now I came up with the following solution which does work:

1) Place a batch file on the user's desktop that launches another command prompt as admin using runas (we have Start > Run hidden by group policy)
2) The new command prompt defaults to C:\WINNT\SYSTEM32 so I place a file called GWDelete.bat in that location. GWDelete.bat contains the netsh command to delete the gateway.

Advantage: Works with no restarts or logoffs required.
Disadvantage: Have to copy the batch file to all 80 PCs and then VNC into each one to make the change.

Although we could easily get those knocked out in a day, there has to be an easier way to do this.

While I'm asking, what would be the correct syntax to accomplish this locally from my PC using netsh -r computername?

 

[da sponge]

Are you using MS DHCP? IIRC you can set (set to nothing?) the default gateway as a DHCP server/scope option.

 

[Lateralus]

Static IPs. There are ~500 workstations total...most people recommend using DHCP with that many nodes but this was all set up before I arrived and I don't think it's changing any time soon.

That's a good and obvious suggestion, though. You're absolutely right about that method. Hmmm...what if I did DHCP reservations for all 80 PCs and changed the default gateway that way? Although typing all those MACs would be cumbersome...

 

[gimp]

Static IPs. There are ~500 workstations total...most people recommend using DHCP with that many nodes but this was all set up before I arrived and I don't think it's changing any time soon.

That's a good and obvious suggestion, though. You're absolutely right about that method. Hmmm...what if I did DHCP reservations for all 80 PCs and changed the default gateway that way? Although typing all those MACs would be cumbersome...

that's the only way.
if you only have 1 DHCP scope, you cannot remove the default gateway for certain machines.
If the machines are spread out on various switches, you cannot assign a new scope to just the Win2k machines.

The only way would be to physically touch each machine and manually configure the IP without a default gateway, or assign DHCP reservations with no default gateway.

 

[gimp]

While I'm asking, what would be the correct syntax to accomplish this locally from my PC using netsh -r computername?

http://support.microsoft.com/?kbid=257748

How to use netsh to configure remote computer

You can configure remote computer uisng netsh with options “-r” for the machine, “-u” for the username, and “-p” for the password, for example: netsh -r cbg001314 -u cbg001314\blin -p password lan show config.

 

[Lateralus]

that's the only way.
if you only have 1 DHCP scope, you cannot remove the default gateway for certain machines.
If the machines are spread out on various switches, you cannot assign a new scope to just the Win2k machines.

The only way would be to physically touch each machine and manually configure the IP without a default gateway, or assign DHCP reservations with no default gateway.

OK...any idea why can't I get netsh working remotely via the command line? That would be faster than anything and therefore my preference.

Another option suggested online was to block those machines from transmitting on port 80 through the firewall, but I don't have access to that device unfortunately.

 

[Lateralus]

http://support.microsoft.com/?kbid=257748

Thanks man, I read that earlier today but couldn't get it to work. I'll VPN to my work machine and try it again and let you know what it says. Maybe we can go from there.

 

[Lateralus]

OK, here's where I am...

C:\>netsh -r ourcomputer -u ourdomain\administrator -p ourpassword interface ip delete address "Local Area Connection" gateway=all

One or more essential parameters were not entered.
Verify the required parameters, and reenter them.
The syntax supplied for this command is not valid. Check help for the correct syntax.

Usage: delete address [name=]<string> [[address=]<IPv4 address>]
             [[gateway=]<IPv4 address>|all]
             [[store=]active|persistent]

Parameters:

       Tag          Value
       name       - Interface name or index.
       address    - The static IP address to delete.
       gateway    - One of the following values:
                    <IP address>: A specific default gateway IP address
                                  to delete.
                    all: Deletes all default gateway IP addresses on the.
                         interface.
       store      - One of the following values:
                    active: Deletion only lasts until next boot.
                    persistent: Deletion is persistent.  This
                                is the default.

Remarks: Deletes a static IP address or a static default gateway from a specified interface.

Examples:

       delete address "Local Area Connection" addr=10.0.0.1 gateway=all

What essential parameters am I missing here?

 

[InvisiBill]

If you can't get netsh to work, you should at least be able to use PsExec to run the command from GWDelete.bat (or run GWDelete.bat itself from a shared location).

 

[da sponge]

yeah scripting using psexec would be a good choice if it comes down to somehow running a bat on each pc.

 

[Lateralus]

Oh snap, you guys might be on to something. I just ran psexec from my PC and successfully removed the gateway from a test machine.

Now to dump a few computer names into a text file, specify that file on the command line and let `er rip...I'll post back with the results.

 

[Lateralus]

It worked on a test group of 4 PCs. Doesn't matter if a limited user is logged on; hell the PC can be sitting at the Ctrl-Alt-Del prompt so we won't be doing this on an individual basis and no user disruption is required. Thanks so much for the nudge in the right direction, guys. I still find it odd that there's no easy way to do this through group policy or pushing out registry edits, but hey whatever works. Turns out this is really easy to do.