we have a request to allow customer to change firewall settings for servers in some OUs. These OUs inherit some policy which sets firewall to off for public and private network profiles. I wonder if there is a way to somehow override this so they are allowed to change firewall settings. This way it is off and greyed out. It seems that creating a policy with "not configured" does not work as overriding value "enabled" or "disabled" I made a testing policy like this. enter image description here

But it stays like this

enter image description here It seems order of policies does not matter here. Do we need to change the inherited policy settings because it is not possible to override "off" with "not configured"


You can filter computers in specific OU by using WMI filters. In Group Policy Management Console scroll down to WMI Filters and create new WMI filter with the following parameters:

Namespace: root\RSOP\Computer

Query: Select * From RSOP_Session Where NOT SOM = 'OU=OrgUnit,DC=Domain,DC=com'

Make sure you replace 'OU=OrgUnit,DC=Domain,DC=com' with OU your servers are in.

Next, select your GPO and select your new filter in WMI Filtering drop-down.

This will filter out this GPO from applying to servers in OU specified in query.

Note: if the servers you want to filters out are not in the same OU, but are in child OUs, you need to modify the query the following way to include all child OUs:

Select * From RSOP_Session Where NOT SOM LIKE '%OU=OrgUnit,DC=Domain,DC=com'

| improve this answer | |
  • Great that works! The only ...BIG... problem is that when the computer receives GPO with firewall settings not configured it seems that default settings for all profiles (domain,private,public) is Firewall on and Inbound connections that do not match a rule are blocked! This caused a big problem. I hope they will not blame me too much :-\ Where is this default value and how can this be changed when firewall is not configured by GPO? – Vitas Jun 27 '16 at 12:45
  • Windows come with firewall on by default. You can control it with Group Policy or manually, but not both at the same time. If you want to add additional firewall rule to those servers (Remote Desktop for example) you might be able to add rules via script and the script to start up scripts section via GPO – Jevgenij Martynenko Jun 27 '16 at 17:11

It isn't possible to override group policy in the general case, but for the Windows Firewall there is an option that will let you do that.

Under the profile (domain / private / public) settings under rule merging there is an option "apply local firewall rules". It won't let you modify the deployed rules but it does let any local changes that need to be made apply.

| improve this answer | |
  • Unfortunately this does not help. If there is one policy settings firewall to off and another with "apply local firewall rules" then the settings is still grey as in my picture above. GPO result here: imgur.com/JZgvKqc – Vitas Jun 20 '16 at 14:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.