As every Windows system administrator should know in 2019, the "Windows Firewall" service is a critical component of the Windows network stack, and it should never, ever be stopped end disabled; the correct way to let any traffic flow into/from a Windows server is to configure the firewall to let anything through, but without actually stopping the Windows Firewall service; in fact, not only this is not supported by Microsoft, but it can lead to any sort of weird networking issues.
This is even (somewhat) explicitly mentioned in the documentation:
Do not disable Windows Firewall by stopping the service. Instead, use one of the preceding procedures (or an equivalent Group Policy setting) to turn the firewall off. [...] Stopping the service associated with Windows Firewall with Advanced Security is not supported by Microsoft.
Now, I have a bunch of servers where the previous sysadmins thought disabling the Windows Firewall service was a good idea, and so they did. I need to reactivate it, but as soon as I do that, I immediately lose network connectivity to the systems (because of course nobody bothered to actually configure Windows Firewall to let things such as RDP in); I also can't manually change the Windows Firewall configuration before restarting the service, either via GUI or via
netsh, because both tools complains about the Windows Firewall service being stopped and thus won't let me configure anything.
So far, the only viable approach has been to use the physical (ok, virtual) console of those servers to re-enable the Windows Firewall service and then set appropriate firewall exceptions (or allow all traffic altogether); however, this is infeasible for a large number of systems or if you don't actually have console access.
How can I configure Windows Firewall to accept all (or some) incoming connections when the service is down and before restarting it?