Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been having some issues with firewall and the likes concerning GPO being applied on my new 2008 DC. Is there anything that would make 2008 act differently than a 2003 server when it comes to GPO policies?

share|improve this question

Your best bet is to create a new group policy object and edit it from the Server 2008 machine (or a Windows 7 machine, if you have one of those). I don't like the idea of installing unrequired software on a production server, but you'll have to find a happy medium between provisioning a new Server 2008 or Windows 7 machine or utilising an existing Server 2008 resource. In any case, here's the basic steps you can utilise:

  1. Install the Group Policy Management Console. On Server 2008, it's part of Server Manager by default. For Windows 7, you will need to install the RSAT update before the Group Policy Management option shows up in the Windows Features section (under the RSAT node).
  2. Edit the new group policy - don't edit an existing policy.
  3. Add the firewall settings you require under the Computer Config > Windows Settings > Security Settings > Windows Firewall with Advanced Security.
  4. Close the group policy editor.
  5. Review the settings of the policy via the Settings tab.
  6. Link the policy object to the OU that contains the Server 2008 machine(s).
  7. Either wait, or run a gpupdate /force on the Server 2008 machine you want the settings to apply to.

The 2008 policies are just files, and they could happily live on a Windows 2000 domain controller. The important part is that they're created by a Server 2008 or Windows 7 machine. That's the key.

share|improve this answer
If the 2008 is in the Domain Controllers OU with a 2003 server, can I just move this another OU? – Seth Feb 23 '11 at 21:23
Plus the location of firewall settings you provided isn't accurate the best I can see... – Seth Feb 23 '11 at 22:03
The only way 2008 can allow RDP through firewall is with no policy. This cant be right, what is wrong? I tried creating a fresh GP with firewall exceptions... – Seth Feb 23 '11 at 23:09
Ok, I didn't follow your instruction properly. Windows Firewall with Advanced does not display in 2003. Im assuming when I enable this it will replicate to the 2003 DC? – Seth Feb 23 '11 at 23:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.