Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running a Windows 7 Workstation in a domain setting.

I'd like to disable the local firewall (temporarily), but I am not allowed to do this because of restrictions in the domain.

"For your security, some settings are controlled by group policy"

I'd like to set up a GPO for this particular machine in AD to allow these changes.

(note: I don't want to disable the firewall in the GPO/AD, simply remove the restrictions so that it can be done locally)

share|improve this question
I'm confused whether you are a domain admin or not? You talk about admin things, but these are things any admin should know. If you're not, ask IT and go through the proper channels. – Ben Pilbrow Mar 26 '11 at 18:48
@grojo Pls advise how to allow domain users to manage firewall for their systems using domain group policy? – Krunal Jul 2 '15 at 5:16

Two questions here: how can one GPO override another, and where are the Win7 firewall settings in Group Policy:

  1. Windows Firewall is a computer setting, so you need to create a new GPO in an OU "closer" to your computer object, or if you create a GPO in the same OU as the existing firewall GPO settings, just ensure it's a higher number in the Link Order for that OU. Then the original firewall GPO will apply, then your, which will overwrite.
  2. Windows Firewall settings are under Computer Configuration > Policies > Windows Settings > Windows Firewall with Advanced Security

You also don't have to totally disable the firewall to get what you want. You can change the local fw policy (if allowed) to stay enabled but allow all incoming. Or add FW rules locally for the ports you want open.

share|improve this answer
Hi, note I don't want to disable/enable the FW in the GPO, just make it optional for the local admin. However you're probably right that allowing all incoming is a better solution to temporarily suspend the FW. – grojo Mar 26 '11 at 22:31

Remove the user from that policy, is the easiest and quickest way, instead of amending the policy for everyone.

Or remove the computer account from the container, or OU where the GPO resides.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.