Server Firewall Keeps R=Turns On After Reboot

Glenn Escarayan 136 Reputation points
2023-02-07T01:06:01.3+00:00

Hi MS Team,

There is GPO to disable to windows firewall but every time the server reboots, the server firewall keeps turns on automatically and set to enable.

Please advise.

Thanks,

GCE

Windows
Windows
A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.
4,747 questions
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,127 questions
0 comments

6 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more

  2. Thameur-BOURBITA 32,511 Reputation points
    2023-02-08T10:20:50.5666667+00:00

    Hi @GCE

    It seems that the GPO is not applied on the impacted machine. Check the list of GPO settings applied on impacted machine by running the following command:

    gpresult /H c:\temp\gpresult.html

    0 comments
  3. Glenn Escarayan 136 Reputation points
    2023-02-08T23:32:57.8233333+00:00

    Hello Bourbita,

    Yes the GPO is not applied. I force apply the GPO it but after reboot, it does not take effect and the firewall is enable again.

    Any thoughts?

    Thanks,

    GCE

    0 comments
  4. Roodenburg, Rico 11 Reputation points
    2023-02-17T08:33:13.8966667+00:00

    I have exactly the same problem with Windows Server 2019. In the GPO we have configured to disable the Windows Firewall. After a daily reboot the firewall is enabled again.

    This issue doesn't occurs with Windows Server 2016, which gets the same GPO settings. I have enabled the audit event for Firewall changes. Event 2002 is interesting:

    A Windows Defender Firewall setting has changed.

New Setting:
	Type:	Current Profile
	Value:	Public
	Modifying User:	NT SERVICE\mpssvc
	Modifying Application:
    0 comments
  5. Glenn Escarayan 136 Reputation points
    2023-02-21T01:50:22.6133333+00:00

    Hello Roodenburg,

    Thanks for the reply Do you have an alternative fix or seen an issue after you enable audit event for firewall changes?

    Appreciate the advise,

    Thanks,

    GCE