Re: Windows Firewall Domain vs. Standard profile problem / Group Policy weirdness

I'm guessing that the exceptions are still there from previously doing what you are trying to do now or that they are in the local GPO. Try searching through the registry for the name of one of the executeables you are expecting to trigger the firewall that you have defined as "allowed" on the old policy.
<ed@xxxxxxxxxxxxx> wrote in message news:1181245462.827591.173370@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
I have an XP SP2 client that was within an OU which had firewall
policies defined. Those policies enabled the firewall with a list of
allowed applications and ports. Now, I've moved this client to an OU
which has the firewall settings set to Not Configured. I also
manually deleted all exeptions from the list and confirmed that the
registry defines no AlowedApplications. I did all of this because I
wanted the user that uses this computer to have to reanswer all of the
"Keep Blocking" prompts so that I can create a new GPO of firewall
settings, updating the old one created by a predecessor. However,
even after the GPO is applied to this machine the old firewall
settings still are in effect.

I've read the Cable Guy article about how firewall profiles (Domain
vs. Standard) are selected. This machine has a static IP with a
manually entered DNS suffix. So, after the article I figured that
because the GPO connection matched my DNS suffix, it still applied
domain policies. To confirm this, I issued the netsh firewall show
state command, resulting in this:

Profile = Domain
Operational mode = Enable
Exception mode = Enable
Multicast/broadcast response mode = Enable
Notification mode = Enable
Group policy version = None
Remote admin mode = Disable

So, the machine is still using the domain profile but theoretically
not using any settings because of the None setting in GP version.
However, while using the computer with an administrator account, I
still received no prompts to approve/deny applications. I
specifically ran applications that were explicitly defined as allowed
in the policy of the other OU. And the programs always ran and always
connected to the Internet, even though no exceptions are defined.

So, next I removed the DNS suffix and forced a GP update. The profile
switched the Standard, but the same behavior remains. The firewall is
enabled, with exceptions enabled, but no exceptions defined, yet any
application that runs has complete Internet access, just as if it was
still using the old domain policy it was assigned. The firewall log
shows all sorts of IP's and ports being allowed. Just for kicks I
disjoined the computer from the domain and rejoined, but that didn't
help either.

Any ideas?


.

Relevant Pages

  • Re: Group Policy Firewall Exception Problem
    ... the domain ends up with two sets of firewall settings. ... I have set up about a dozen or more Windows 2003, R2 servers on our AD ... and those OUs had a common GPO linked to them. ...
    (microsoft.public.windows.group_policy)
  • Re: Installation of XP SP2 prevents access to SBS 2K3 Exchange?
    ... re-install my server (among other things I managed to delete "my company ... What I've noticed the first time, was that a lot of settings on the client's ... >> shut down the firewall. ... I think that a new GPO has been created, ...
    (microsoft.public.windows.server.sbs)
  • Re: Problems with looping through ISA Server
    ... If I unchecked 'automatically detect settings', ... In the exceptions, I have tried both: ... But I always get the BLOCKED BY ISA page even after trying to put it ... PS We do force all our users to use ISA as a Proxy server and use a GPO ...
    (microsoft.public.isa.configuration)
  • Re: XP machine removed from domain still gets domain policy
    ... My test shows that when a computer is removed from a domain (that had a GPO setting the Firewall settings), the Firewall settings revert back to the default and local administrators can change the settings. ... the only Group Policy being applied is the "Local Group Policy" ...
    (microsoft.public.windows.group_policy)
  • Re: Strange XP Firewall issue with GPO
    ... If so, in Control Panel, Windows Firewall, the "Don't allow exceptions" with have a check mark and it will be "greyed out" even for administrators. ... If you want to prevent local administrators from adding exceptions, set these settings to Disabled in the GPO: ... 135 TCP IPv4 ...
    (microsoft.public.windows.server.active_directory)
Quantcast