I found an interesting issue where I set a GPO to control the firewall policy to "Block (default)" the inbound connections, however that setting is not completely enforced. It still allows an administrator to alter it from "Block (default)" to "Block all connections".
Why is the GPO not forcing the setting I provided?
In more detail:
The settings i'm referring to are in:
- Go to Windows Advanced Firewall
- Right click on properties
- Under any profile tab, in my case Domain Profile
- State > Inbound Connections
The GPO is set explicitly to "Block (default)", however this option can still be changed once the GPO is applied.