If your firewall enforces traffic according to originating users, open these ports for traffic coming from %BRAND_WINDOWS_SHORT% ...