Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I know from direct personal experience that disabling the Windows Firewall service on post-XP systems can lead to all sorts of networking problems, and that the proper way of disabling it is by configuring it to not block any traffic, yet leaving the actual service running. This is because from Vista onwards the Windows Firewall service is a critical component of the Windows networking stack, and stopping it will wreak havoc in completely random ways.

However, I keep stumbling upon people who think that just stopping and disabling the service is a fine solution, and that taking your time to properly disable it is simply too much unneeded work. Then, when all sorts of network pains ensue, they just won't acknowledge the real reason, and will try anything else before grudgingly accepting that, yes, maybe that service should be really left running.

Apart from hitting those people with heavy (and/or sharp) objects, the real solution here would be an official document stating "don't disable this service or you are just asking for troubles". And yet, the only post on this topic I was able to find simply says that "stopping the service associated with Windows Firewall with Advanced Security is not supported by Microsoft", which just doesn't look threatening enough to stop them from doing idiotic things.

Is there anything better I can refer to in order to back up my claim that the Windows Firewall service should indeed NOT be stopped?


A bit of clarification: I was actually not referring to users, but to admins with too much attitude and too little real knowledge, who think the above-described configuration is Just Right, implemented it via GPOs on their whole network, and are simply not listening when I tell them that those random network problems they are experiencing have a very high chance of being caused by it.

I'm currently tasked with fixing those problems (and implementing some new services which are not working as expected because of this issue), and I need a way to persuade them to just leave that f***ing service alone; sadly, personal experience seems to not be official enough.

share|improve this question

1 Answer 1

up vote 11 down vote accepted

You already know what the best practice is; the MS-supported thing to do. You've already seen how disabling the service can lead to unpredictable behavior and that it breaks other functionality that's tangentially tied to the service. If you, as an administrator, don't have the power to stop the idiots from doing idiotic things, then escalate this to the administrator who does and have him or her put in a GPO. Have the policy makers at your company make it policy that this service is not to be disabled. Then they're not just being idiots, they're violating company policy.

http://superuser.com/questions/137930/when-the-windows-firewall-service-is-disabled-i-cannot-remote-desktop-rdp-to-t

http://weestro.blogspot.com/2009/06/server-2008-and-windows-firewall.html

share|improve this answer
1  
Disabling the firewall breaks IPSec, for one thing. –  mfinni Jul 3 '13 at 15:13
    
Expanded for clarity. I'm having troubles persuading other admins of this, not users. –  Massimo Jul 3 '13 at 17:19
2  
You write "the real solution here would be an official document stating "don't disable this service or you are just asking for troubles", then in the very next sentence, you link to an official MS document saying "don't disable this service or you are just asking for troubles!" On top of that, I included two links as examples of guys who broke RDP because they disabled the service. On top of that, I told you that if your admins make bad choices, that is an HR problem and should be addressed through company policies. Not sure what else to give you. –  Ryan Ries Jul 3 '13 at 17:33
4  
"Stopping the service associated with Windows Firewall with Advanced Security is not supported by Microsoft." That is a statement from the vendor. –  Ryan Ries Jul 3 '13 at 19:04
2  
@Massimo That Technet article is abundantly clear. If your coworkers don't understand it, then perhaps they aren't competent to hold their current positions. –  Michael Hampton Jul 4 '13 at 3:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.