Solved

how to disable and enable client's firewall through GPO

Posted on 2016-10-11
16
52 Views
Last Modified: 2016-10-20
how to disable and enable client's firewall through GPO. Windows 2012 R server. Goal is to disable the clients firewall, push the agent out. Then disable the firewall. Please advise me. Thanks.
0
Comment
Question by:abcd ab01
  • 10
  • 5
16 Comments
 
LVL 6

Expert Comment

by:Niten Kumar
Comment Utility
Create a GPO and apply to all computers, or you could modify say the default policy. I would recommend creating a new policy for security and set it there.

Then set under

Computer Config > Policies > Administrative Templates > Network > Network connections > Windows Firewall > Domain Profile  > Windows Firewall: Protect all network connections = Disabled

After then go to client machine;


Start > Run > CMD > Gpupdate /force

Check the Firewall in Control Panel should be disabled
0
 

Author Comment

by:abcd ab01
Comment Utility
Can you please walk me over to following steps too see below-

create a GPO and apply to all computers, or you could modify say the default policy. I would recommend creating a new policy for security and set it there.
0
 
LVL 6

Expert Comment

by:Niten Kumar
Comment Utility
How many client computers do you have and do you want to apply this to all the computers.  How is your OU structured?

If you want to apply to one OU then it is best to create a separate GPO altogether for this.  Make sure all the correct computers accounts are in the OU.  Best would be test with one computer account.  Create the GPO with above configuration and apply it to the OU.  Apply the next GPO which will push the agent you want to deploy.
0
 

Author Comment

by:abcd ab01
Comment Utility
First I would like to create a separate test GPO and assigned to a separate test ou where only pilot machines will reside.

We are pushing gpo to disable the firewall. Do I need to set inbound or outbound firewall too?
0
 

Author Comment

by:abcd ab01
Comment Utility
200 clients later, but 3-4 for test only
0
 
LVL 6

Expert Comment

by:Niten Kumar
Comment Utility
So have you placed this 3-4 computers in a separate OU and created a new GPO with the above settings.
0
 

Author Comment

by:abcd ab01
Comment Utility
not yet but planning
0
 
LVL 6

Expert Comment

by:Niten Kumar
Comment Utility
If you can do that then we can proceed with the next steps
0
What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 

Author Comment

by:abcd ab01
Comment Utility
thanks Niten, I will let you know when I'm done with 1st and 2nd steps.
0
 
LVL 10

Expert Comment

by:Maclean
Comment Utility
Just a quick opinion. I would not disable firewall on clients. It is there to protect them. Best to push a firewall policy out which includes safe applications & ports allowed.
Yes it is more work, but it is best practice. Unless you are planning on using Symantec Firewall instead.
But if this is the case Symantec will sort the firewall status, so the policy is redundant.
0
 

Author Comment

by:abcd ab01
Comment Utility
firewall will be disabled for a while. After disabling, we will push heat agent and then will enable the firewall. But symantec will take care of Firewall, we are planning to implement Symantec endpoint security soon.
0
 

Author Comment

by:abcd ab01
Comment Utility
I created this> Crreate a GPO and apply to all computers, or you could modify say the default policy. I would recommend creating a new policy for security and set it there.

Then set under

Computer Config > Policies > Administrative Templates > Network > Network connections > Windows Firewall > Domain Profile  > Windows Firewall: Protect all network connections = Disabled"

Hoh to add test pilot ou TO THIS GPO
0
 

Author Comment

by:abcd ab01
Comment Utility
HI Niten, can you please answer above question? Thanks.
0
 
LVL 6

Accepted Solution

by:
Niten Kumar earned 500 total points
Comment Utility
Go to Group Policy management console and look for Group Policy Objects under your domain.  Right-click on it and click on New.  Give a suitable name such as block-firewall and click on OK.  You will see that the new Group Policy Object has been created.  Now right-click on it and click on Edit.  Apply the above settings.  Now go to the test pilot OU and right-click on it and Click on Link an Existing GPO and link the Group Policy that you just created.  Now close GPMC and wait for settings to apply and testout on the client.
0
 

Author Closing Comment

by:abcd ab01
Comment Utility
thanks!!
0
 

Author Comment

by:abcd ab01
Comment Utility
Hi Niten,

Is there any gpo can be created to add gpupdate /force to all corporate machine and reboot by itself? So that the new policy for disabling firewall can be implemented though the gpo? We don't want to go to each computer and run gpupdate and reboo. Please suggest me. Thnaks.
0

Featured Post

Do email signature updates give you a headache?

Do you feel like you are constantly making changes to email signatures? Are the images not formatting how you want them to? Want high-quality HTML signatures on all devices, including on mobiles and Macs? Then, let Exclaimer solve all your email signature problems today.

Join & Write a Comment

If you migrate a Terminal Server licenses server inside the 2008 server family, you can takte advantage of the build-in migration tool. If you like to migrate an older 2003 Server (and the installed client CALs) to a 2008 R2 server for example, you …
In this article, we will see the basic design consideration while designing a Multi-tenant web application in a simple manner. Though, many frameworks are available in the market to develop a multi - tenant application, but do they provide data, cod…
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now