Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

I want to make sure that every computer on the domain has the Windows Firewall switched on and the user (even if logged in as Administrator) cannot switch this off.

I know how to do this locally on a per machine basis, but how would I do this on Windows Server 2003 to ensure that this applies to every computer?

share|improve this question
Moving to Server Fault, as how to configure a GPO is more in their area. – AviD Mar 21 '12 at 7:44
1  
If you don't want users switching parts of the system off then don't let them log in an an administrator - there is even a clue in the username. I know its not what you want to hear but its true and there's little point sugar coating it – RobM Mar 21 '12 at 8:03
Why the -1? I think this is a fair question! – JMK Mar 25 '12 at 18:55

migrated from security.stackexchange.com Mar 21 '12 at 7:44

3 Answers

up vote 5 down vote accepted

Yes you can manage Windows Firewall through GPO.

Computer Config > Windows Settings > Security Settings > Windows Firewall.

I use GPO for my mixed 2k3 and 2k8 environment.

Can you lock out the local Admin? I don't think so. For that, you might need a centrally managed commercial firewall package. I know Symantec Endpoint Protection has this feature, for instance.

share|improve this answer
+1, but remember, a determined admin can still undo the settings on a "centrally managed" product. – RobM Mar 21 '12 at 8:02
up vote 1 down vote

Like schroeder said, you can manage the Firewall settings by GPO udner:

Computer Configuration -> Windows Settings -> Security Settings -> Windows Firewall with Advanced Security

These settings will however affect everyone that is logged on to the PC. Also administrators. When accessing the properties it will show you this (note the grayed Firewall state).

enter image description here

I wrote a blog about these settings that you can read in: http://zeda.nl/b21

share|improve this answer
up vote 1 down vote

I have used GPOs in Win2k3 and Win2k8 environment as well. Check out Microsoft's article on Deploying Windows Firewall Settings With Group Policy if you haven't already. Then run gpupdate on the machines or wait for the settings to be pushed out.

As for user rights, I recommend only giving the minimum needed for them to function. The users who demand more privileges but don't need them will figure a way around this security measure or just give up. I always say that it cannot be granted unless documented in writing to avoid legal issues later on for that user.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.