4

How do I view the actual, effective firewall rules for a Windows 7 computer where the local firewall is disabled but rules are established via group policy?:

enter image description here

In particular, the primary users of these computers are techinically competent developers who have local administrative rights. It seems possible that a clever one could update their own registry to deny access to SYSTEM account on applicable keys and thus thwarting group policy.

Both GUI (WF.msc) and command line (netsh advfirewall firewall show rule name=all) show all the locally defined rules -- most of which don't actually do anything because local settings are superceded by group policy.

3

In your screenshot, the firewall is off. This means that no rules that are created are going to matter.

If you really want to see what's being applied by policy, it should show up in rsop.msc.

  • +1 Answer = RSOP. It gave a clear explanation that a certain policy has disabled the local firewall. So I guess that really did mean there are no rules! I suppose I'll have another question then, elsewhere... – Joshua Honig Nov 1 '12 at 19:37
  • Yeah, I just had to wait a couple more minutes...and then forget :)- – Joshua Honig Nov 2 '12 at 12:11
0

This depends on your Windows Version. In Windows XP you could see firewall rules in rsop.msc.

Windows 7 behaves different:

Firewall rules appear in rsop.msc only under Computer Configuration, Administrative Templates, Extra Registry Settings.

The Firewall GUI (wf.msc) shows both local settings and those from group policy. And you can let it add a column which shows the "rule source", i.e. whether a rule is local or from a GPO.

Note: local settings are by default not superseded by group policy, instead all settings apply.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.