0

I am experiencing an issue with Windows Firewall via Group Policy on Windows SBS 2008. When moving any machine, physical or virtual, from our primary SBSComputers OU to our SBSServers OU (no parent/child relationship to one another, both children of Domain>MyBusiness>Computers), Windows Firewall is activated and remote access to the machine is disabled in Advanced System Settings. I have been able to replicate the issue on multiple machines. Assuming that this behavior must be a result of a GPO setting of which I was unaware, I ran RSOP on the machines and dug through every GPO that had been applied, but found nothing that explains the change. The Firewall setting "Protect All Network Connections" had been enabled for the SBSComputers OU (the original location of the machine), but it has never been enabled for the SBSServers OU (the destination). Even after disabling this setting for the SBSComputers OU (so it is no longer enabled anywhere in our environment) the same issue occurs when the above scenario is replicated.

I am still getting a handle on Group Policy Management and learning how to manipulate GPOs, so my hope is that I am simply overlooking something that will be obvious to those of you with more experience.

5
  • Is the servers OU under the computers OU? It could be inheritance. Oct 13, 2014 at 23:03
  • 2
    In the GPMC run the Group Policy Results wizard against the affected server. Then view the report and make note of any GPO's that are applied under Computer Configuration Summary. Then go audit each of those GPO's. Also, there's no such thing as a standalone OU with no parent relationship. An OU always has a parent relationship either with a higher level OU or at the domain level. So in your case, where the OU has no parent OU, any GPO's linked at the domain level may be configuring those settings, which GPRESULTS will show you.
    – joeqwerty
    Oct 13, 2014 at 23:55
  • Apologies, I looked back at my original question and see that I was not as specific or as clear as I could have been; I have made a few edits.
    – mblasco
    Oct 14, 2014 at 11:38
  • @theterribletrivium, no, the SBSServers OU is not under the SBSComputers OU, rather they are on the same level, both children of Domain>MyBusiness>Computers.
    – mblasco
    Oct 14, 2014 at 11:49
  • @joeqwerty, the the word "standalone" was poorly chosen; I meant to say that the two OUs had no parent/child relationship to one another, but instead are both children of the Computers OU - I have modified my original question to reflect these clarifications. I have run RSOP on the affected machines and found that no GPO is applied that modifies firewall settings - I have not run the Group Policy Results Wizard yet, I will do so shortly.
    – mblasco
    Oct 14, 2014 at 13:23

0

You must log in to answer this question.

Browse other questions tagged .