How to prevent Windows Firewall from disabled

My company currently is deploying policy to disable Windows Firewall by writing keys to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall. I don't feel it's good to disable it, so removed the key and removed "Full Access" from HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft Just that the system now complain that it can't create key HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\BITS

Is there any way to prevent the Firewall control interface go dim when HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall exist? I learnt that if this key exist, the firewall controlling UI will be locked, which also mean that when I write applications that listen to blocked ports, I wouldn't get notification to unblock it.

1) No. The entire point of Group Policy is to allow central configuration of settings. If the administrators have determined that the firewall should be disabled, then it will be disabled. If you don't agree with this you should follow whatever internal procedures there are for raising your concerns, or learn to live with it.

2) If the firewall is disabled there won't be any blocked ports, so I'm not sure what you're expecting. If the firewall is enabled but configuration managed centrally then you are right in thinking you won't see any UI from Windows to indicate that ports are blocked.

1) It's just that I don't want to go through the trouble with management and then other I.T. staffs. I've lived with Windows Firewall for a long time and learnt how to live with it. Having it disabled makes me feel a bit unprotected. (It's funny you mentioned "learn to live with it"... I'd think it's to "learn to live without it". )

2) If this were possible, I can just alter the registry to create HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall then make it read-only to Administrators and SYSTEM to prevent global policy to meddle with it. It's unlikely that the group policy will precognize what project I'll do in future and open the port for me ahead. It'd be better to have me open the port when needed.

The way I see it is if you connect your machine to somebody's domain controller, you're giving them the right to decide what happens to your machine. They want to turn off your firewall - fine, it's off. They want to install their own SSL certs to man-in-the-middle your gmail or run programs that log your every keystroke on your machine? Well that's what you signed up for when you joined their domain.

If you don't agree to the group policy, you shouldn't join the domain.

You could always run your non-domain controlled machine and have a domain controlled VM if you need to access specific resources that need a domain-joined machine, but you'll need to check with IT that you're not breaking their rules by doing so.

I guess the best is to get your own PC that's not part of the domain. So, if your business PC got hacked or virus due to security holes, it only affect your business PC, not your personal contents on your own PC.

@evildictaitor:The problem is that we're using TFS as source control, and TFS only works with domain accounts. And I'll also need domain access to connect the central document repository as they've configured it that way.

I hope that Windows can make a few registry keys so if the domain policy is making the computer have less secure setting, individual user with local administrator right can have some way to override it.

@magicalclick:Actually I don't have much personal things in my company PC. For most of time, in the rare situation that I really need computer to do something personal, I'll just connect back to my home using remote desktop.

It's my working philosophy that I'm always ready to be promoted or fired by tomorrow. Requiring much time to clean up my things just aren't my style. *grin*

@cheong: Disabling the machine firewall makes sense in a scenario where the machine is behind a hardware firewall.  However, if you are outside the hardware firewall (i.e. a remote worker) then your machine may need to be moved to a different policy group.  Usually IT has a separate policy outside the hardware firewall for this very reason.  If it turns out IT doesn't have you in the wrong group then you could buy a cheap dlink NAT which should do the trick.

20 hours ago, davewill wrote

@cheong: Disabling the machine firewall makes sense in a scenario where the machine is behind a hardware firewall.  However, if you are outside the hardware firewall (i.e. a remote worker) then your machine may need to be moved to a different policy group.  Usually IT has a separate policy outside the hardware firewall for this very reason.  If it turns out IT doesn't have you in the wrong group then you could buy a cheap dlink NAT which should do the trick.

Group Policy itself understand multiple modes of the firewall depending upon whether you are on the domain or a private/public network so the admins may already have configured it appropriately. Although personally I think keeping WF on even behind a hardware firewall is a sensible idea.

I don't, however, understand why you're worried about ports being blocked if domain policy is disabling the entire firewall, because then they obviously won't be blocked. Indeed that may have been the entire motivation behind them doing so.

@blowdart:I wonder... Can you explain more why when I'm asking for way to override if it makes the computer settings less secure, it could render group policy useless?

@cheong: Because the purpose of Group Policy is to centralise configuration, if people can just override central decisions on a whim it's all a bit pointless.

If your admins wanted the firewall enabled, but also wanted you to have the option of making local exceptions there is actually a Group Policy configuration which allows that. Since that's not how it's set up, that's obviously not what they want.

18 hours ago, cheong wrote

@blowdart:I wonder... Can you explain more why when I'm asking for way to override if it makes the computer settings less secure, it could render group policy useless?

Local user (David, a mere underling) < Administrator (Jane, an manager) < Group Policy Administrator (Martin, the head of IT).

Jane is being annoyed by Windows Update restarting her computer every other Tuesday. Martin says "We need to install Windows Updates, otherwise we'll get hacked"

Should Windows Update be turned on?

Answer: Yes.
Why? Because Group Policy wins any dispute, and its word is law.

Alternative: Jane turns off Windows Update, company gets hacked, Martin says "ZOMG What happened - group policy has this forced on"
Result: group policy has failed in its mission to standardize the IT infrastructure, causing massive pain to the company because you allowed an administrator to override the company's group policy.

@evildictaitor:No, no, no... I'm not asking for feature that will just override group policy, I'm asking for way to override it when:

1) The user want to overrule it is local Administrator (this is obvious requirement)
2) The user want to overrule a setting that makes the computer less secure. (i.e.: The user can force firewall to start even if group policy makes it stop, but not to stop the firewall when group policy requires it to start)

@blowdart:In my previous companies, I've experienced virus attack from Shenzhen office through VPN more than once, so I don't feel relying on hardware firewall is enough.

I don't know how they managed that, but if I were admin there, I'd setup a Linux box with iptable + squid and with policy to block traffic that can't be scanned (except to some banks and mail services maybe), things ought to be better.

@blowdart: Admitted it's not that simple, especially since there is also another requirement to "not locking firewall settings (port/application exception and network masks, etc.) if GP is disabling firewall and computer has override", but my request sounds reasonable enough, right?