Configure Windows Firewall via Group Policy

Question

Hello,

Our company wants to restrict communication between server and Clients they have decided to enable windows firewall via Group Policy and open only required ports we have Client / Server environment like Multiple Active Directory Server, Microsoft AX Application server and few more servers to communicate to the clients.

I have given the task to perform in the following ways

• Outbound Connection from the server can be Any
• Inbound connection to restrict with ports
• Client Firewall and Server Firewall must be turned on via GPO
• Allow only Specific Inbound Ports from Both Server and Client Side.
• Create Separate OU for Client and Server machine

Can you help to know how I can achieve the above and what kind of

Regards,

Ehsan

Answer 1

You can follow along here.
https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security
https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/config-firewall-for-ad-domains-and-trusts#windows-server-2008-and-later-versions
https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

Hi EhsanShakeeb-3732,

You will need to open specific ports and allow specific applications in order to allow the services you require to work. You haven't listed everything you need, but here's a link to the firewall settings for Microsoft Dynamics AX:

https://learn.microsoft.com/en-us/dynamicsax-2012/appuser-itpro/firewall-settings-for-microsoft-dynamics-ax-components

Here is a link to the firewall configuration for AD domains:

https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/config-firewall-for-ad-domains-and-trusts

You can manage WIndows Firewall via Group Policy:

https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/open-the-group-policy-management-console-to-windows-firewall-with-advanced-security

--------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept as answer--

Answer 3

Hello,

thank you for the above posts just want to ask that enabling firewall via GPO doesn't take of Active Directory communication server to server and Server to Client and Client to Server do we have enable the ports for communication.

Kindly advise.

Regards,

Answer 4

Active Directory communication server to server and Server to Client and Client to Server do we have enable the ports for communication.

Nothing needs to be done assuming both got the domain network profile. When NLA starts to detect the network location, the machine will contact a domain controller via port 389. If this detection is successful, it will get the domain firewall profile (allowing for correct ports) and we cannot change the network location profile.
If the domain was not found or process failed, NLA will let you to determine which firewall profile will be used, private or public.

--please don't forget to upvote and Accept as answer if the reply is helpful--