In Windows Server 2012 and 2012R2, is it possible to set future network connections to use the Private firewall profile instead of defaulting to Public one?

I have tried setting all the network items to Private in secpol.msc -> Security Settings -> Network List Manager Policies, but when ever I connect a new network it always defaults to Public.

Alternatively, is there a way to re-enable the "Set Network Location" dialog that is presented in non server versions of windows. This would at least help alleviate the issue.

  • NOT the answer, but an explanation: It is defaulting to public because it is not on a domain profile, is not a DC and DNS lookups (to identify the network) are failing, making the network that you are on an "Unknown" network. – G Koe Mar 13 '14 at 21:39

This security "feature" is by design. Servers on a "new" or "unrecognized" network will default to the public profile. Because it is not on a domain profile, is not a DC and DNS lookups (to identify the network) are failing, it defines the network that you are on as an "Unknown" network, and thus defaulting to the "public" profile.

You could get around this issue by joining the server to a domain, and doing so would set the network location to “Domain network”. Although this solution might not be ideal or even possible for you if you constantly connecting to "new" networks.

If you are on a trusted network and this is happening or this server is a DC, setting the service "Network Location Awareness" to delayed start will resolve this issue.

If you server is "traveling" to different networks or a DC is not present, you can run the following powershell script (From the windows powershell team blog) to set all network profiles to "private":

# Skip network location setting for pre-Vista operating systems
if([environment]::OSVersion.version.Major -lt 6) { return }

# Skip network location setting if local machine is joined to a domain.
if(1,3,4,5 -contains (Get-WmiObject win32_computersystem).DomainRole) { return }

# Get network connections
$networkListManager = [Activator]::CreateInstance([Type]::GetTypeFromCLSID([Guid]"{DCB00C01-570F-4A9B-8D69-199FDBA5723B}"))
$connections = $networkListManager.GetNetworkConnections()

# Set network location to Private for all networks
$connections | % {$_.GetNetwork().SetCategory(1)}

If you want to create a scheduled task to run this script at boot, here is a great tutorial: "Use the Windows Task Scheduler to Run a Windows PowerShell Script".

  • The scenario I have is that I'm setting up servers that will go to a different sites, most of which wont have a DC. This script will do the job. – SausageFingers Mar 14 '14 at 12:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.