1

With Windows Vista Business, I'd like to completely disable any group policy (both local and domain) control over the Windows Firewall so that I can turn it off and on at will on the computer directly. I have admin rights on the computer and the domain and I thought I removed all the applicable group rules controlling the firewall, but when I open the Firewall settings it still tells me that group policy is managing it and won't let me turn it on or off.

Is there a way to tell which group policy, Local or Domain is in effect?

This is my first experience with group policy, so any guidance on freeing up this control is appreciated.

Improve this question
3
  • 2
    run elevated gpupdate /force?
    – tony roth
    Jun 25, 2010 at 16:26
  • Doesn't solve the problem, but that's a good tool to have for testing different settings, thanks.
    – RyanW
    Jun 25, 2010 at 16:32
  • is the workstation in the correct ou?
    – tony roth
    Jun 25, 2010 at 16:38

2 Answers 2

Reset to default
3

Running the Resultant Set of Policy snap-in -- rsop.msc will generate a report of applied GPOs and which settings are in effect. You can browse the report using the same interface you use to browse "real" GPOs.

http://technet.microsoft.com/en-us/library/cc736424%28WS.10%29.aspx

Improve this answer
4
  • just so you know rsop.msc does not show all gpo settings!
    – tony roth
    Jun 25, 2010 at 16:38
  • 1
    But it should detail the firewall Computer settings under Administrative Templates, Network, Network Connections, Windows Firewall -- provided a GPO is applying these settings.
    – jscott
    Jun 25, 2010 at 16:41
  • 1
    @tony roth: It will show if any GPOs have Firewall settings though.
    – Chris S
    Jun 25, 2010 at 16:41
  • Yes, this did the trick! It showed that the policy that was providing the firewall settings. I changed the policy it reported, ran gpupdate /force that @tony suggested and I can now turn the firewall on and off.
    – RyanW
    Jun 25, 2010 at 18:02
0

If your computer is a member of a domain then it will be pulling the GPO that is linked to the container your computer is in and will refresh that policy upon logging in. You can see what policies are being applied, in the gui, via gpedit or loading the group policy snapin in MMC.

If you are a domain admin, and you want custom GPOs, you can edit the AD. Add another container below the one you are in now, move your computer there, and have no inheritance (blocking GPOs from applying from above).

Improve this answer
1
  • Thanks, I ran gpedit on the vista computer, but it doesn't show me what policies are being applied that I can tell. The rsop.msc application/command did however.
    – RyanW
    Jun 25, 2010 at 18:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .