At the moment we are managing Windows Firewall on servers manually, on a one-on-one basis. This works but is cumbersome, for example if a change is needed for a new agent or something it's painful to modify each system.

I could group the servers into functions and apply Group Policy based rules based on systems that are alike but with the majority being SQL or Application servers the commonality between systems is quite low due to different ports and applications being used.

Does anyone have a solution for managing Windows Firewall rules on a large collection of windows servers?

  • "the commonality between systems is quite low due to different ports and applications being used." So each server has a different set of applications on it? I'm surprised firewall management is your only (or biggest) problem. Surely there is some ability to group servers based on ports that they need open. I can't see how hundreds of server could even be created in a reasonable way without many of them being essentially the same. May 31 '16 at 13:02
  • They are existing servers which have been built over time, each server hosts different applications. Even the SQL servers have instances which means different ports are in use. I would expect many enterprise environments would be very similar. May 31 '16 at 13:05

If you deploy the rules through group policy, then you will at least of all the rules documented outside of the systems/an excel spreadsheet. This will also allow you to use security groups to filter the application of the rules to each server.

From a security standpoint, you will want to avoid apply rules to open ports on servers that don't need them open.

Depending on the number of servers, it might work to create one GPO per port, create a security group, populate it with the servers, and use that group for filtering. All the SQL servers should be using the same default port ranges for connections unless the defaults were modified.

  • I like the "GPO per port" idea, although I suggest modifying it to be a GPO for each service or group of services. For example, a GPO for "web services" might open both ports 80 and 443. That can cut down on the number of GPOs that would be required. And of course, contemplating this many GPOs means best practices should definitely be researched and applied to creating this GPO solution. May 31 '16 at 14:35
  • I was thinking the same thing but then you run the risk of opening ports on servers that don't need them open. An example would be a server that just needs 443 but you have it in the group for Web Services that opens port 80 and 443. That may work for applications though that are always going to use the same ports. May 31 '16 at 14:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.