Group Policy:  How do I enable Windows Firewall for public connection, but disable for company LAN/WAN/VPN?

Will give that a whirl...

ACK! I knew it wasn't going to be that easy...

The group policy was set-up as indicated:.

1.  The default domain policy (applied to all domain computers) includes the administrative template: Network/Network Connections/Windows Firewall/Domain Profile/Windows Firewall: Protect all network connections - Disabled
 NOTE:  This setting has been in existence for some time (we've always had the Windows Firewall set so that it was off and no one could turn it on)

2. A test OU container labeled 'FW Test' was created.  A special test 'Firewall Policy' GPO was created and linked to the FW Test' OU container.  The Firewall Policy GPO included the following Administrative Template:  Network/Network Connections/Windows Firewall/Standard Profile/Windows Firewall: Protect all network connections -- Enabled

3.  A couple of test machines that had already been a member of the domain for some time were added to the FW Test container.  

4.  I ran gpupdate /force to update the computer's policy.  I even restarted several times just for good measure.

5.  I ran RSOP.MSC on the computer to view the Resultant Set of Policy.  All looked great!  within the Administrative Templates/Network/Network Connections/Windows Firewall/Standard Profile, the Windows Firewall: Protect all network connections was Enabled.  Within the Network/Network Connections/Windows Firewall/Domain Profile, the Windows Firewall: Protect all network connections setting was Disabled.

6.  I quickly ran to the nearest public Internet connection believing this was EASY.  The Firewall (SharedAccess) service wasn't started.  I couldn't even start it as an administrator manually through the GUI, or command line.

7.  At a loss, I completely removed the PC computer account from the domain and added it to a workgroup -- The Firewall service still wouldn't start.

8.  I set out to find the problem using the error message that appeared when I would try to start the service manually:  "Windows Firewall settings cannot be displayed because the associated service is not running. Do you want to start the Windows Firewall/Internet Connection Sharing (ICS) service?
If you click Yes, you receive the following error message:
Windows cannot start the Windows Firewall/Internet Connection Sharing (ICS) service"

CURRENTLY
I'm at Microsoft KB Article --   http://support.microsoft.com/kb/892199
...states that certain Administrative templates have problems and the default security descriptor for the SharedAccess service needs to be restored.  Which is fine, but the method for doing so seems like it's going to be a huge pain for the couple hundred machines that this policy setting needs to be applied to...

ANY Thoughts?  Perhaps the GPO(s) weren't set-up exactly right?  I smell a call to Microsoft Support coming.

To add insult to injury, I cannot perform the first method of restoring the default security descriptor:   I get "[SC] OpenService FAILED 5:  Access is denied"

ok, I just loaded a brand new Windows XP SP2 Image and had first boot-up into a Workgroup -- I could manually switch the Firewall on or off at will using the GUI or command line -- no problem.

I added the PC to the domain -- what looks to be the correct resultant set of group policy shows (Domain - Disabled; Standard - Enabled) -- went to a public Internet site and the firewall service will not start (automatically or manually).  

So, either the application of the Domain=WF Disabled policy by way of the Default Global Domain policy, and then using a sub container and separate test policy that simply enables the firewall in the Standard folder -- is not the way to go and breaks the permissions to the Firewall service.

Yes, I did... did a total shutdown... went out the door and traveled to a public Internet (wifi) site.  Powered-up, and nothing.  An IPconfig /all verifies that a totally new and foreign DNS suffix is shown -- all knew Gateway and DNS servers...

One thing I did find was that the actuall Firewall/ICS service was disabled in the default domain policy... this was in addition to the Domain/Protect All Network connections being disabled.

The service was set to 'Automatic' in the default domain policy... did what seemed like 50 gpupdate /force refreshes... and still can't get the service to start whether detached from the domain or on a different domain.  

While on the public Internet access, I ran the "netsh firewall show state" comman line.  I kept getting "This service has not been started"  When I tried to manually start it, no luck.

Is it possible to totally hose the service with domain policy so that it can never be used again no matter what one does?  

I'm beginning to wonder if having the domain profile being set in the default domain policy and the standard profile being set (enabled) in a a sub container and separately linked GPo are the problem.  Perhaps they have to both be a part of the same GPo?

okay... set the default domain policy to "not configured" for the Domain Profile\ 'Protect all network connections'

Then performed all necessary settings in the test GPo only.  RSOP indicates the domain profile is 'disabled' the standard profile is "enabled"

Going to go to public Internet now and see how she goes.  

Out of curiosity, I did disconnect from our network altogether and try to manually start the firwall service which was sitting -- not started, but set to automatic (as we'd set in default domain policy).

Got the same error -- "Could not start the Windows Firewall\ICS service on Local Computer.  Error 0x80004015:  The class is configured to run as a security ID different from the caller"

hehe... I forgot to try that KB article again (end of my second comment) after having removed the disabled status of the Firewall/ICS service in the defaul domain policy....  Method 1 worked this time... I'm off to the public connection -- again.  ;-)  Yes, it'd be nice to have a lab setup with a different domain to connect to, will definitely be doing that.

Fingers crossed...