1

With Windows Vista Business, I'd like to completely disable any group policy (both local and domain) control over the Windows Firewall so that I can turn it off and on at will on the computer directly. I have admin rights on the computer and the domain and I thought I removed all the applicable group rules controlling the firewall, but when I open the Firewall settings it still tells me that group policy is managing it and won't let me turn it on or off.

Is there a way to tell which group policy, Local or Domain is in effect?

This is my first experience with group policy, so any guidance on freeing up this control is appreciated.

RyanW
  • 528
  • 3
  • 9
  • 19

2 Answers2

3

Running the Resultant Set of Policy snap-in -- rsop.msc will generate a report of applied GPOs and which settings are in effect. You can browse the report using the same interface you use to browse "real" GPOs.

http://technet.microsoft.com/en-us/library/cc736424%28WS.10%29.aspx

jscott
  • 24,484
  • 8
  • 79
  • 100
  • just so you know rsop.msc does not show all gpo settings! – tony roth Jun 25 '10 at 16:38
  • 1
    But it *should* detail the firewall Computer settings under Administrative Templates, Network, Network Connections, Windows Firewall -- provided a GPO is applying these settings. – jscott Jun 25 '10 at 16:41
  • 1
    @tony roth: It will show if any GPOs have Firewall settings though. – Chris S Jun 25 '10 at 16:41
  • Yes, this did the trick! It showed that the policy that was providing the firewall settings. I changed the policy it reported, ran gpupdate /force that @tony suggested and I can now turn the firewall on and off. – RyanW Jun 25 '10 at 18:02
0

If your computer is a member of a domain then it will be pulling the GPO that is linked to the container your computer is in and will refresh that policy upon logging in. You can see what policies are being applied, in the gui, via gpedit or loading the group policy snapin in MMC.

If you are a domain admin, and you want custom GPOs, you can edit the AD. Add another container below the one you are in now, move your computer there, and have no inheritance (blocking GPOs from applying from above).

Chadddada
  • 1,680
  • 1
  • 19
  • 26
  • Thanks, I ran gpedit on the vista computer, but it doesn't show me what policies are being applied that I can tell. The rsop.msc application/command did however. – RyanW Jun 25 '10 at 18:04