Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have the following GPO's configured for our default domain policies:

  • Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Domain Profile Settings
    • Firewall state -- Off
  • Computer Configuration\Policies\Administrative Templates\Network\Network Connections\Windows Firewall\Domain Profile
    • Windows Firewall: Protect all network connections -- Disabled
  • Computer Configuration\Policies\Administrative Templates\Network\Network Connections\Windows Firewall\Standard Profile
    • Windows Firewall: Protect all network connections -- Disabled

Recently, we've had some strange hiccups that required a few machines to be taken off of the domain and be rejoined. However, after being removed and completing it's first reboot, the Windows Firewall turns itself back on and blocks our attempts to connect remotely to rejoin it.

Although I'm not aware of this being an issue for us in the past, is this default behavior for when a machine is removed from the domain?

share|improve this question
up vote 2 down vote accepted

The Windows Advanced Firewall has three profiles: Domain, Public, and Private/Home. Each profile has its own settings. When you leave a domain, the Domain profile gets disabled and the Private profile gets activated. You need to ensure that the Private profile does not activate using netsh advfirewall command.

For more info:

share|improve this answer
I had a sneaky suspicion this was the case. Thank you for the info! – RecursiveGreen Jan 13 '14 at 20:07

By Default, the windows firewall is turned on. If you have a policy to turn off the firewall set by GPOs, there's no way to ensure the policy you want or don't want will be set when its removed from the domain. Rejoining to the domain should always be followed with manual GP updates using the following from the command prompt.

GPUpdate /force


This ensures the system pulls completely up to date policy. The only way to really prevent this is to also disable it at the local policy level.

share|improve this answer
Your answer is correct, but I think @pepoluan has more relevance to my current situation. Thanks! : ) – RecursiveGreen Jan 13 '14 at 20:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .