Home / server / Questions / 364952
Accepted
poconnor
Asked: 2012-03-01 09:04:34 +0800 CST

Firewall GPO will not go away

  • 772

I recently created a GPO for turning on the firewall for everyone, but now I need it removed so that everyone can manage there own firewall. I tried to delete it and it just goes to a default firewall setting, but still has the managed by a system administrator box up at the top. No one can edit there own firewall. How can I get things back to normal?

windows-server-2008 group-policy

2 Answers

  1. Best Answer

    This is governed by Windows Firewall Group Policy Settings - specifically, "Windows Firewall: Protect all network connections" (ability to set general state) and "Allow local exceptions" group (ability to configure exceptions).

    I suspect that after you deleted the GPO, the registry settings it had set didn't go nowhere. To check this, see HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\<all subkeys>|EnableFirewall in registry on a workstation (should be absent). (see Fix: Windows XP Firewall Settings grayed out (Windows XP) - TACKtech Corp. for illustrated explanation of the same)

    Alternatively, it's some other GPO that may be affecting your workstations. Use rsop.msc on one of them to check for this possibility.

    • 0

  2. As I remember, removing GPO's does not change anything, this is more or less by design. Most settings/rules in GPO's are transparent by default which means that they don't change anything. Deleting the GPO therefore means that your rules goes back to transparent and just won't change anything.

    To revert the settings back to normal, you have to apply the default settings manually. I'm not 100% sure about this though!

    • 0