0

On a Windows 7 Enterprise 64-bit laptop joined to a corporate domain, the Windows Firewall is disabled by a global policy.

Is there any way to enable the Windows Firewall in this scenario?

The gpedit.msc setting Windows Firewall: Protect all network connections is inaccessible.

EDIT: It appears that changing HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\gpsvc\Start value to 4 will disable the GPO and allow you to start the firewall and stop the bots from pushing cr*p to your computer... will check on Monday and if it works I'll confirm here in case someone else in my situation wonders upon this question...

EDIT: It's probably better if I write a mock windows service not doing anything and name it according to what is expected to be on my box and than crete mock McCrappy executable and mock McCrappy folder structure and remove all the actual stuff... That would take a little time but would most certainly make my box completely stealthy...

2 Answers 2

2

The registry key you want to target is

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\

Make the DWord = 0.

That's funny that you have access to that registry key. That just means any Group policy updates that get pushed down are ineffective since you can just overwrite it. While I sympathize with other IT workers, this is not really excusable. . .

It means you have all sorts of hacks available to you, including disabling Group Policy updates from the domain controller. But that would raise suspicions. But if you want, Microsoft's Technet actually tells you how to disable the updates.

I would go with changing the update interval. That is more subtle.

I feel your pain though.

Software developers get no love. IT folks don't get any love either. I have a hard time explaining to people that I don't make the rules. We gotta make painful decisions because of laws, regulations, and cost inefficiencies. It sucks. Just like developers, we are asked to do everything fast, perfect and for cheap.

At the same time, IT has a job to do and you are only making it harder on others, which they in turn increase the control on your computers, which forces you to be more clever. . . You are smart enough to see where this is going.

Really, this is just a short term solution to a long term problem. You aren't going to gain any trust by braggin about number of processes or calling people bots.

BTW, you should know as a developer that # of process != performance.

Edit

I don't sympathize with IT departments that make make users admins, simply cause it is easier. It really isn't that hard to create a power user group with install priviledges, etc etc.

8
  • Thanks for that registry key, I understand your point of view but just as I don't understand the specifics of your situation, no one understand the specifics of mine. So when I get condesending comments about not knowing what runs on my computer and the number of icons next to my clock assuming I'm a noob or just out of school or something I get a little annoyed and fire off. I was an admin myself before becoming a developer and had to deal with hacks othes tried to pull off and hated that job more than having to deal with ppl who blindly follow rules and just push McCrappy to developer boxes.
    – Dean Kuga
    Jul 17, 2011 at 0:00
  • However, my problem is not with IT admins, after all they just implement policies "well thought out" by others but with the layers of administration built on top of IT that doesn't really do anything useful but constantly try to "invent", impose and enforce new garbage on developers AND other IT people in order to simply justify their existance and their days filled with productive meetings.
    – Dean Kuga
    Jul 17, 2011 at 0:05
  • When we get to the point that it takes more time for us to go through layers upon layers of red tape they invented to justify their existence in order to get something done, than to actually write the code and create something useful and it still doesn't dawn on them that they must be doing something wrong we are entering the area where, at least in my opinion, anything is allowed to protect yourself from these aparatchiks...
    – Dean Kuga
    Jul 17, 2011 at 0:11
  • I don't understand the start of your rant, you can only edit that registry key if you're an admin on the box. If you're an admin on the box, all bets are off. Jul 17, 2011 at 0:32
  • @todda Writing good software is difficult enough without having to deal with people who are constantly making your life harder instead of helping which ought to be their job, so when you experience that you can call my venting a rant... and yes I am an admin on the box...
    – Dean Kuga
    Jul 17, 2011 at 1:03
1

Sorry, you can't in the long run. If you are a local admin, you could probably change it in the registry, but the default update interval on group policy is 90 minutes, meaning it would change it back then every 90 munites...a real pain in the butt.

If you really want it enabled, and you are on a network where you can talk to your admin, ask them to do this:

Create a new OU and move your computer to it. They can then make a copy of the current GP renamed, and then make the change you requested. They would then link the changed GP to the new OU.

Whether they will do this or not it is hard to say. For me, it would mostly depend on it you left the ports open I needed to manage your computer (this might negate your reason for doing it though), otherwise I have no problem with a user wanting to be a bit more secure.

15
  • 3
    P.S. It is kind of against informal policy here to help anyone get around settings enforced by administrators.
    – KCotreau
    Jul 16, 2011 at 11:08
  • Even if administrators are corporate bots who were told to push the virus named McAfee, which renders a computer pretty much useless, to every workstation on the domain even if they already have Security Essentials installed? Reasoning with corporate bots is useless so when you start typig in your Visual Studio and nothing appears on the screen for 10 seconds workarounds are all you have left unfortunatelly...
    – Dean Kuga
    Jul 16, 2011 at 11:26
  • Anyway, do you know what key needs to be changed in the registry? I can schedule a job that will change the registry every 90 minutes if you do... my goal is to prevent the bots from pushing the McAfee virus to my workstation...
    – Dean Kuga
    Jul 16, 2011 at 11:27
  • 1
    @kzen - the 'bots' are probably responsible for the network-wide security and MS Security Essentials doesn't provide the centralized management that McAfee offers. Just remember, you're not using your computer. PS: using MS Security Essentials in a business with more than 10 users is against the license. If you installed it you may be risking trouble for installing illegal applications on your company's system. Jul 16, 2011 at 15:39
  • If you are waiting that long for text to show up, you have different problems besides McCrappee. You should start complaining about system slowness and showing how slow your computer is to anyone who'll listen, IT or not. It could be you have loads of software running that you don't need (how many icons are there next to your clock that you have no idea what they are?), or you may just need a little more computer memory (this is pretty cheap and in all likelihood IT has spare chips lying around you could use). Jul 16, 2011 at 16:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .