On a fresh domain-joined Server 2012 R2 install I see a peculiarity where an enabled "Remote Desktop" rule is set to Block in the Domain profile:
As block rules take precedence over allow rules, I seem unable to effectively insert a firewall exception allowing RDP traffic to this machine. I cannot edit this rule as "This rule has been applied by the system administrator and cannot be modified". I also cannot override it by the "Remote Desktop" predefined rule in a Group Policy as this does not update the "Remote Desktop" rule but is introducing a new "Remote Desktop (TCP-In)" rule, with the "Remote Desktop" block rule still in place and taking precedence.
Contrary to what the Rule Source column (the first column in the screenshot above) is telling me, the rule is not defined in the machine's local policy:
Folks seem to have encountered this problem on older (Windows 7 / 2008 R2) installs as well, yet there seems to be no effective resolution documented in these cases.
So where does this come from and how to disable this block rule?