XP Firewall resets itself for no reason?

[irbk]

Hello,
There are several things that we do to each of the computers on our network on Windows Firewall that are not set through a group policy. We allow file and printer sharing on TCP port 445, edit the scope of addresses that can access the port, etc..

There will be several times when we set up the firewall just the way we want it for remote admin access, netmeeting, etc, everything works great for an hour or two or perhaps longer. Then, out of the blue, for no apparent reason, the Windows Firewall looses all it's settings. We look at the firewall and it looks like it was never set up at all. So we go through and set it up again and some times it stays, some times we need to set it up a 3rd time. Anyone have any idea why this is happening and what we can do to stop it from happening?

Thanks in advance.

 

[stduc]

Have you tried re-booting immediately after setting it up? Do the setting survive the re-boot?

I have been known to be wrong.
The best way to thank someone who helps you is give them a star.

 

[irbk]

Yes, it survives a reboot. Sometimes it survives several reboots. Sometimes it doesn't give us any problems, then out of the blue, for no reason, the firewall goes back to the default settings.

 

[stduc]

I presume you have triple checked for virus's and malware? I also presume you have checked that the GPO isn't being applied somehow.

The firewall settings are set by an admin user. Do these machines have more than one admin user by any chance?

I have been known to be wrong.
The best way to thank someone who helps you is give them a star.

 

[irbk]

No virus's or malware. These systems are brand new out of the box running McAfee. The GPO has no policy set at all for the Firewall. Anyone that is a "domain admin" has local admin rights on the machine so yes, basically there is more then 1 admin account. It used to be that when a different user logged on, some times the firewall settings changed, some times they didn't. However, we have recently experienced the issue with the same user account that set the firewall settings to begin with (and no other users had logged onto the machine).

 

[jhaith]

What's the output of gpresult and the gpo settings for Comp Config> Admin Templates> Network> Network Connections> Windows Firewall> # Profile for each?

Also have you checked gpresult after this problem has happened and checked Event Viewer> Application to make sure settings were applied successfully?

Are these computers set to wait for network before logging on? I've seen policies not applied or applied incorrectly if the network is not present during logon.


-jhaith

 

[irbk]

I'm confused. How, when the gpo is NOT applying any settings to the firewall, is your focus so much on gpo?

 

[jhaith]

A GPO overwriting the local user settings seemed to be a very logical explanation to your problem, the firewall doesn't magically just reset it's settings without a reason (atleast last time I checked). However, I misread that you're only setting the local settings on the firewall and not managing them through group policy which is what should be done imo, even if only the local GPO. I would check to see when Group Policy is applied in correlation with the settings being lost though, again just my opinion. Please post back when you resolve this, very curious to hear why this is happening.

-jhaith