I have an environment where we have a GPO which we have set on all profiles to have the setting: Apply local firewall rules: No

I've confirmed that the GP is applied successfully by using gpresult/rsop.

On occasion, a block rule will be added to the system locally by MPSSVC which prevents my customer's application from working. We also have an explicit allow rule for the same process which is added by GPO. We can manually remove the block rule but it eventually comes back.

How is this rule getting added despite having the GPO in place for no local firewall rules?

  • I'm not sure, but you may find that turning on the "Windows Defender Firewall: Prohibit Notifications" group policy setting prevents this from happening. – Harry Johnston Jul 1 '18 at 1:16

The documentation says that this settings is used when the user "clicks Allow on the notification message".

It's working as intended, Microsoft never said that the rules created by "something else" will not be applied.

Apply local firewall rules: Yes. We recommend that you allow users to create and use local firewall rules. If you set this to No, then when a user clicks Allow on the notification message to allow traffic for a new program, Windows does not create a new firewall rule and the traffic remains blocked.

  • Thanks for this. I'm a little confused on this part in the document: " If you and the IT staff can create and maintain the list of firewall rules for all permitted applications and deploy them by using GPOs then you can set this value to No." In our case, we are deploying the rules by GPO but I take it that it is still possible that rules may be added by "something else," is that correct? – Grant C Jul 5 '18 at 15:54
  • 1
    If you can't manage the firewall rules with a GPO (because you don't want to manage these rules, or if you are in an environment with a lot of exceptions, if each computers needs a different set of rules,...) then you can set this value to Yes, so your users won't be stuck because the local firewall denied the connection – Swisstone Jul 5 '18 at 16:45
  • Thank you. This is the behavior I am seeing where UAC will prompt for the rule to be added, the user doesn't get the option to allow/block the application in WinFW. It is blocked automatically. – Grant C Jul 5 '18 at 20:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.