2

Recently a new piece of software started being included in our corporate Windows 7 image that, during silent install during the deployment process with Windows Deployment Workbench, sets the Windows Firewall to always be on via enabling the following setting in the domain machine's local security policy:

Computer Configuration → Administrative Templates → Network → Network Connections → Windows Firewall → Domain Profile → Windows Firewall: Protect all network connections

I've addressed the issue by installing the software into the image, changing the setting back and then capturing it back into Windows Deployment Services, but there's still about twenty laptops from the last two months when I started including it to when I noticed the problem that have their local security policy enabled.

The setting should be "not configured" so that administrators can turn the firewall on and off. My question is how to return a policy to 'not configured' since that does not override enabled or disabled by inheritance.

Improve this question
4
  • 1
    There absolutely is, and I could go around to each machine individually, but I'm trying to avoid that. My understanding of the problem is that since the policy is set in local, domain policies of 'not configured' are overridden.
    – Queso
    Jul 19, 2014 at 15:57
  • Ohhhh, ok. I missed the twenty laptops part. Sorry!
    – ᔕᖺᘎᕊ
    Jul 19, 2014 at 16:27
  • 1
    No, the order of Group Policy processing and precedence is as follows: LSDOU, which means Local, Site, Domain, OU. So if you create a GPO at the Site, Domain or OU level and set the setting to Not Configured that will override the Local setting and make it Not Configured. - technet.microsoft.com/en-us/library/cc785665(v=ws.10).aspx. The article Is from the Windows 2003 TechNet Library but the order of GPO processing and precedence hasn't changed.
    – joeqwerty
    Jul 19, 2014 at 18:25
  • Are there any other settings that have been configured in Local Group Policy on the affected workstations?
    – I say Reinstate Monica
    Aug 12, 2014 at 2:59

2 Answers 2

Reset to default
0

Try with:

Computer SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile
EnableFirewall
DELETE

This will reset it to "Not configured".

Regards.

Improve this answer
0

Setting an AD policy to "Not configured" means you are not configuring any policy, and so the client settings will remain set to whatever they are currently set to.

If you want to revert the settings back to defaults you have to determine what those default settings were, and then create a policy to assign those settings to the clients.

If you need it really set back to "Not Configured" on the client, then you'll need to delete the associated registry key(s) on the client, as kralizeck pointed out in his answer.

Improve this answer
5
  • Sometimes "not configured" is the default setting. In Chrome, BookmarkBarEnabled is a boolean with three behaviors: enabled, disabled, and not configured.
    – Stevoisiak
    May 24, 2019 at 15:58
  • @StevenM.Vascellaro While what you're saying may be true (and is a dumb move on Google's part), it still doesnt' change what I'm saying. When you set a AD GP to "not configured" it does not affect the client. As it means "I have no policy for this, do whatever you're already doing". If you need it really set back to "Not Configured" on the client, then you'll need to delete the registry key on the client (in the case of your example), as kralizeck pointed out in his answer.
    – Ƭᴇcʜιᴇ007
    May 24, 2019 at 17:53
  • Deleting the key will work temporarily, but group policy may re-create the key after a restart.
    – Stevoisiak
    May 24, 2019 at 18:09
  • @StevenM.Vascellaro If the related GP is set to "not configured", then, as said, it won't affect the client, and as such, won't create any related keys.
    – Ƭᴇcʜιᴇ007
    May 24, 2019 at 18:17
  • Let us continue this discussion in chat.
    – Stevoisiak
    May 24, 2019 at 18:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .