How to return a GPO to Not Configured?
Recently a new piece of software started being included in our corporate Windows 7 image that, during silent install during the deployment process with Windows Deployment Workbench, sets the Windows Firewall to always be on via enabling the following setting in the domain machine's local security policy:
Computer Configuration-Administrative Templates-Network-Network Connections-Windows Firewall-Domain Profile-Windows Firewall: Protect all network connections
I've addressed the issue by installing the software into the image, changing the setting back and then capturing it back into Windows Deployment Services, but there's still about twenty laptops from the last two months when I started including it to when I noticed the problem that have their local security policy enabled.
The setting should be "not configured" so that administrators can turn the firewall on and off. My question is how to return a policy to 'not configured' since that does not override enabled or disabled by inheritance.
Thank you for your help!
windows-7 windows group-policy
asked Jul 19 '14 at 15:01
QuesoQueso
613
add a comment |
Recently a new piece of software started being included in our corporate Windows 7 image that, during silent install during the deployment process with Windows Deployment Workbench, sets the Windows Firewall to always be on via enabling the following setting in the domain machine's local security policy:
Computer Configuration-Administrative Templates-Network-Network Connections-Windows Firewall-Domain Profile-Windows Firewall: Protect all network connections
I've addressed the issue by installing the software into the image, changing the setting back and then capturing it back into Windows Deployment Services, but there's still about twenty laptops from the last two months when I started including it to when I noticed the problem that have their local security policy enabled.
The setting should be "not configured" so that administrators can turn the firewall on and off. My question is how to return a policy to 'not configured' since that does not override enabled or disabled by inheritance.
Thank you for your help!
windows-7 windows group-policy
asked Jul 19 '14 at 15:01
QuesoQueso
613
There absolutely is, and I could go around to each machine individually, but I'm trying to avoid that. My understanding of the problem is that since the policy is set in local, domain policies of 'not configured' are overridden.
– Queso
Jul 19 '14 at 15:57
Ohhhh, ok. I missed thetwenty laptopspart. Sorry!
– ᔕᖺᘎᕊ
Jul 19 '14 at 16:27
1
No, the order of Group Policy processing and precedence is as follows: LSDOU, which means Local, Site, Domain, OU. So if you create a GPO at the Site, Domain or OU level and set the setting toNot Configuredthat will override the Local setting and make itNot Configured. - technet.microsoft.com/en-us/library/cc785665(v=ws.10).aspx. The article Is from the Windows 2003 TechNet Library but the order of GPO processing and precedence hasn't changed.
– joeqwerty
Jul 19 '14 at 18:25
Are there any other settings that have been configured in Local Group Policy on the affected workstations?
– Twisty Impersonator
Aug 12 '14 at 2:59
add a comment |
Recently a new piece of software started being included in our corporate Windows 7 image that, during silent install during the deployment process with Windows Deployment Workbench, sets the Windows Firewall to always be on via enabling the following setting in the domain machine's local security policy:
Computer Configuration-Administrative Templates-Network-Network Connections-Windows Firewall-Domain Profile-Windows Firewall: Protect all network connections
I've addressed the issue by installing the software into the image, changing the setting back and then capturing it back into Windows Deployment Services, but there's still about twenty laptops from the last two months when I started including it to when I noticed the problem that have their local security policy enabled.
The setting should be "not configured" so that administrators can turn the firewall on and off. My question is how to return a policy to 'not configured' since that does not override enabled or disabled by inheritance.
Thank you for your help!
windows-7 windows group-policy
asked Jul 19 '14 at 15:01
QuesoQueso
613
Recently a new piece of software started being included in our corporate Windows 7 image that, during silent install during the deployment process with Windows Deployment Workbench, sets the Windows Firewall to always be on via enabling the following setting in the domain machine's local security policy:
Computer Configuration-Administrative Templates-Network-Network Connections-Windows Firewall-Domain Profile-Windows Firewall: Protect all network connections
I've addressed the issue by installing the software into the image, changing the setting back and then capturing it back into Windows Deployment Services, but there's still about twenty laptops from the last two months when I started including it to when I noticed the problem that have their local security policy enabled.
The setting should be "not configured" so that administrators can turn the firewall on and off. My question is how to return a policy to 'not configured' since that does not override enabled or disabled by inheritance.
Thank you for your help!
windows-7 windows group-policy
windows-7 windows group-policy
asked Jul 19 '14 at 15:01
QuesoQueso
613
asked Jul 19 '14 at 15:01
QuesoQueso
613
asked Jul 19 '14 at 15:01
QuesoQueso
613
asked Jul 19 '14 at 15:01
QuesoQueso
613
asked Jul 19 '14 at 15:01
QuesoQueso
613
613
There absolutely is, and I could go around to each machine individually, but I'm trying to avoid that. My understanding of the problem is that since the policy is set in local, domain policies of 'not configured' are overridden.
– Queso
Jul 19 '14 at 15:57
Ohhhh, ok. I missed thetwenty laptopspart. Sorry!
– ᔕᖺᘎᕊ
Jul 19 '14 at 16:27
1
No, the order of Group Policy processing and precedence is as follows: LSDOU, which means Local, Site, Domain, OU. So if you create a GPO at the Site, Domain or OU level and set the setting toNot Configuredthat will override the Local setting and make itNot Configured. - technet.microsoft.com/en-us/library/cc785665(v=ws.10).aspx. The article Is from the Windows 2003 TechNet Library but the order of GPO processing and precedence hasn't changed.
– joeqwerty
Jul 19 '14 at 18:25
Are there any other settings that have been configured in Local Group Policy on the affected workstations?
– Twisty Impersonator
Aug 12 '14 at 2:59
add a comment |
There absolutely is, and I could go around to each machine individually, but I'm trying to avoid that. My understanding of the problem is that since the policy is set in local, domain policies of 'not configured' are overridden.
– Queso
Jul 19 '14 at 15:57
Ohhhh, ok. I missed thetwenty laptopspart. Sorry!
– ᔕᖺᘎᕊ
Jul 19 '14 at 16:27
1
No, the order of Group Policy processing and precedence is as follows: LSDOU, which means Local, Site, Domain, OU. So if you create a GPO at the Site, Domain or OU level and set the setting toNot Configuredthat will override the Local setting and make itNot Configured. - technet.microsoft.com/en-us/library/cc785665(v=ws.10).aspx. The article Is from the Windows 2003 TechNet Library but the order of GPO processing and precedence hasn't changed.
– joeqwerty
Jul 19 '14 at 18:25
Are there any other settings that have been configured in Local Group Policy on the affected workstations?
– Twisty Impersonator
Aug 12 '14 at 2:59
There absolutely is, and I could go around to each machine individually, but I'm trying to avoid that. My understanding of the problem is that since the policy is set in local, domain policies of 'not configured' are overridden.
– Queso
Jul 19 '14 at 15:57
There absolutely is, and I could go around to each machine individually, but I'm trying to avoid that. My understanding of the problem is that since the policy is set in local, domain policies of 'not configured' are overridden.
– Queso
Jul 19 '14 at 15:57
Ohhhh, ok. I missed the
twenty laptops part. Sorry!– ᔕᖺᘎᕊ
Jul 19 '14 at 16:27
Ohhhh, ok. I missed the
twenty laptops part. Sorry!– ᔕᖺᘎᕊ
Jul 19 '14 at 16:27
1
1
No, the order of Group Policy processing and precedence is as follows: LSDOU, which means Local, Site, Domain, OU. So if you create a GPO at the Site, Domain or OU level and set the setting to
Not Configured that will override the Local setting and make it Not Configured. - technet.microsoft.com/en-us/library/cc785665(v=ws.10).aspx. The article Is from the Windows 2003 TechNet Library but the order of GPO processing and precedence hasn't changed.– joeqwerty
Jul 19 '14 at 18:25
No, the order of Group Policy processing and precedence is as follows: LSDOU, which means Local, Site, Domain, OU. So if you create a GPO at the Site, Domain or OU level and set the setting to
Not Configured that will override the Local setting and make it Not Configured. - technet.microsoft.com/en-us/library/cc785665(v=ws.10).aspx. The article Is from the Windows 2003 TechNet Library but the order of GPO processing and precedence hasn't changed.– joeqwerty
Jul 19 '14 at 18:25
Are there any other settings that have been configured in Local Group Policy on the affected workstations?
– Twisty Impersonator
Aug 12 '14 at 2:59
Are there any other settings that have been configured in Local Group Policy on the affected workstations?
– Twisty Impersonator
Aug 12 '14 at 2:59
add a comment |
2 Answers
2
active
oldest
votes
Setting an AD policy to "Not configured" means you are not configuring any policy, and so the client settings will remain set to whatever they are currently set to.
If you want to revert the settings back to defaults you have to determine what those default settings were, and then create a policy to assign those settings to the clients.
answered Jul 19 '14 at 17:48
Ƭᴇcʜιᴇ007Ƭᴇcʜιᴇ007
99.4k14156217
add a comment |
Try with:
Computer SOFTWAREPoliciesMicrosoftWindowsFirewallDomainProfile
EnableFirewall
DELETE
This will reset it to "Not configured".
Regards.
answered Oct 23 '18 at 10:50
kralizeckkralizeck
1
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f785214%2fhow-to-return-a-gpo-to-not-configured%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
Setting an AD policy to "Not configured" means you are not configuring any policy, and so the client settings will remain set to whatever they are currently set to.
If you want to revert the settings back to defaults you have to determine what those default settings were, and then create a policy to assign those settings to the clients.
answered Jul 19 '14 at 17:48
Ƭᴇcʜιᴇ007Ƭᴇcʜιᴇ007
99.4k14156217
add a comment |
Setting an AD policy to "Not configured" means you are not configuring any policy, and so the client settings will remain set to whatever they are currently set to.
If you want to revert the settings back to defaults you have to determine what those default settings were, and then create a policy to assign those settings to the clients.
answered Jul 19 '14 at 17:48
Ƭᴇcʜιᴇ007Ƭᴇcʜιᴇ007
99.4k14156217
add a comment |
Setting an AD policy to "Not configured" means you are not configuring any policy, and so the client settings will remain set to whatever they are currently set to.
If you want to revert the settings back to defaults you have to determine what those default settings were, and then create a policy to assign those settings to the clients.
answered Jul 19 '14 at 17:48
Ƭᴇcʜιᴇ007Ƭᴇcʜιᴇ007
99.4k14156217
Setting an AD policy to "Not configured" means you are not configuring any policy, and so the client settings will remain set to whatever they are currently set to.
If you want to revert the settings back to defaults you have to determine what those default settings were, and then create a policy to assign those settings to the clients.
answered Jul 19 '14 at 17:48
Ƭᴇcʜιᴇ007Ƭᴇcʜιᴇ007
99.4k14156217
answered Jul 19 '14 at 17:48
Ƭᴇcʜιᴇ007Ƭᴇcʜιᴇ007
99.4k14156217
answered Jul 19 '14 at 17:48
Ƭᴇcʜιᴇ007Ƭᴇcʜιᴇ007
99.4k14156217
answered Jul 19 '14 at 17:48
Ƭᴇcʜιᴇ007Ƭᴇcʜιᴇ007
99.4k14156217
99.4k14156217
add a comment |
add a comment |
Try with:
Computer SOFTWAREPoliciesMicrosoftWindowsFirewallDomainProfile
EnableFirewall
DELETE
This will reset it to "Not configured".
Regards.
answered Oct 23 '18 at 10:50
kralizeckkralizeck
1
add a comment |
Try with:
Computer SOFTWAREPoliciesMicrosoftWindowsFirewallDomainProfile
EnableFirewall
DELETE
This will reset it to "Not configured".
Regards.
answered Oct 23 '18 at 10:50
kralizeckkralizeck
1
add a comment |
Try with:
Computer SOFTWAREPoliciesMicrosoftWindowsFirewallDomainProfile
EnableFirewall
DELETE
This will reset it to "Not configured".
Regards.
answered Oct 23 '18 at 10:50
kralizeckkralizeck
1
Try with:
Computer SOFTWAREPoliciesMicrosoftWindowsFirewallDomainProfile
EnableFirewall
DELETE
This will reset it to "Not configured".
Regards.
answered Oct 23 '18 at 10:50
kralizeckkralizeck
1
answered Oct 23 '18 at 10:50
kralizeckkralizeck
1
answered Oct 23 '18 at 10:50
kralizeckkralizeck
1
answered Oct 23 '18 at 10:50
kralizeckkralizeck
1
1
add a comment |
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f785214%2fhow-to-return-a-gpo-to-not-configured%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
There absolutely is, and I could go around to each machine individually, but I'm trying to avoid that. My understanding of the problem is that since the policy is set in local, domain policies of 'not configured' are overridden.
– Queso
Jul 19 '14 at 15:57
Ohhhh, ok. I missed the
twenty laptopspart. Sorry!– ᔕᖺᘎᕊ
Jul 19 '14 at 16:27
1
No, the order of Group Policy processing and precedence is as follows: LSDOU, which means Local, Site, Domain, OU. So if you create a GPO at the Site, Domain or OU level and set the setting to
Not Configuredthat will override the Local setting and make itNot Configured. - technet.microsoft.com/en-us/library/cc785665(v=ws.10).aspx. The article Is from the Windows 2003 TechNet Library but the order of GPO processing and precedence hasn't changed.– joeqwerty
Jul 19 '14 at 18:25
Are there any other settings that have been configured in Local Group Policy on the affected workstations?
– Twisty Impersonator
Aug 12 '14 at 2:59