Solved

Administrator overide GPO firewall settings

Posted on 2014-02-25
7
307 Views
Last Modified: 2014-02-25
I have networks where the Windows Firewall settings are configured through Group Policy. This makes it so the firewall cannot be turned off. Is there a way to configure this so an administrator can disable the Windows Firewall?
0
Comment
Question by:ajdratch
  • 3
  • 2
  • 2
7 Comments
 
LVL 36

Expert Comment

by:Mahesh
ID: 39886844
Do you want to disable or enable firewall through GPO ?

Unable to get clarity on your question

However I can tell you

Create a new GPO and apply it on OU containing computers
Specify below settings depending upon your requirements (enable or disable)

Navigate to Computer configuration\policies\windows settings\security settings\windows firewall with advanced security and right click on windows firewall with advanced security-LDAP and go to properties
based on your requirements turn on \ off firewall state for private, public and domain profiles

Also navigate to Computer configuration\policies\windows settings\security settings\system services and enable \ do not define windows firewall service with automatic mode

Also navigate to computer configuration\administrative templates\windows components\security centre and enable \ disable "turn on security centre (domain PCs only)

Once you enable \ disable these all settings, then apply this policy to OU containing computers and also select this policy in GPMC , right click and select enforce

Now this policy will not be overwritten by any other firewall policy and enforced to all computers in scope

Note: Do not apply this policy at domain level, otherwise all servers, domain controllers also get affected with this policy

Mahesh
0
 
LVL 38

Expert Comment

by:Hypercat (Deb)
ID: 39886887
Basically, as Mahesh sort of indicated, the only way to do this is to create a new GPO and apply it only to the Domain Admins group, or to the Administrator account specifically if that's the only account you want to exempt.  What I would do is create the policy and then set ONLY the Windows firewall policy the way you want it.  This way, any other policies that would normally apply when the account logs on will be applied also.
0
 

Author Comment

by:ajdratch
ID: 39886905
I was hoping for a way to let an administrator unload the firewall at a users computer. These administrators do not have access to GPO
0
Portable, direct connect server access

The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.

 
LVL 36

Expert Comment

by:Mahesh
ID: 39886930
Still unable to understand what you are trying to say

You mean does administrators have ability to enable \ disable firewall on client computers ?
0
 
LVL 38

Expert Comment

by:Hypercat (Deb)
ID: 39887063
Once a group policy is set and applied according to the computer and user settings in that GPO, then they are enforced until a different set of group policies is applied.  The only way to apply a different set of group policies is to log on with a different user ID that is set up to use a different group policy object.  How is the computer going to "know" that an administrator is turning off the firewall, unless the administrator is logged on to the computer?  So, as I described, in order for the administrator to be able to turn off the firewall at a user's computer, the administrator would have to have a different GPO applied to that account, and he/she would have to log on to the user's computer with his/her logon ID and password.  This logon would cause the administrator's policy to be applied instead of the user's policy, which would allow the administrator to turn off the firewall.  The firewall would be off only as long as the administrator is logged on.  When the user logs back on, the firewall would be back on because that is part of the policy that applies to the user.

I know it sounds a bit complex but it's really logical. Policy A applies to the user and turns on the firewall and the firewall stays on while the user is logged on.  Policy B applies to the administrator and turns off the firewall and it stays off as long as the administrator is logged on. That's the only way to do it.
0
 
LVL 36

Accepted Solution

by:
Mahesh earned 500 total points
ID: 39887116
Since the firewall settings is for computer, applying it on user basis (administrator) will not help

Even if you apply multiple policies to computers, the one that is last applied will win, it will not check who is logged on to computer

The only way I can see is to move computer in different OU where you have set policy (disable firewall) and then run gpupdate /force to make it effective

Mahesh
0
 

Author Closing Comment

by:ajdratch
ID: 39887478
This is what I have been doing but I was hoping to find a work around. As you said, the policy is applied to the computer and not user so creating one for administrator will not help. My problem is trying to find a way for administrators  to turn it off without accessing GPO. Sounds like it cannot be done.
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

I'm a big fan of Windows' offline folder caching and have used it on my laptops for over a decade.  One thing I don't like about it, however, is how difficult Microsoft has made it for the cache to be moved out of the Windows folder.  Here's how to …
Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
This tutorial will give a short introduction and overview of Backup Exec 2012 and how to navigate and perform basic functions. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as conne…
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question