Windows Firewall on networked PCs?

[Nozza]

Is there really a lot of point in having Windows Firewall enabled on workstations in the school network bearing in mind the net connection is firewalled and proxied by us and the county?

[FN-GM]

The only reason i would use it is for laptops that are used on a home network connection.

[leco]

Agree with FN-GM
Workstations have firewall turned off - teacher laptops automatically get firewalled when not connected to our network.

[MatthewL]

Our's have it turned off, and when off the network is turns it's self on and puts in various rules for what we need access to.

[localzuk]

We have it enabled for one reason - to prevent the spread of viruses. Why disable it? Shouldn't it be on by default, with exceptions. ie. a secure base to work on.

[EduTech]

Firewall is turned off on all workstations, laptops have it turned off when not on the network.

But i do agree with Localzuk, If you have it turned on and just configure the exceptions via GPO it cant do more harm than good.

[cookie_monster]

We have it turned on on all stations and then configure the ports we require, your perimeter firewall is useless if someone brings an infected laptop or USB drive in and plugs it into your network. I've never had any issues with the windows firewall, it's free and doesn't really have any overhead so why not use it it's just another layer of defense available to you.

[localzuk]

Firewall is turned off on all workstations, laptops have it turned off when not on the network.

But i do agree with Localzuk, If you have it turned on and just configure the exceptions via GPO it cant do more harm than good.

Turned off when not on the network? Doesn't that mean that when they plug in to their own, poorly protected, home network they end up with a laptop open to the elements??

[EduTech]

Turned off when not on the network? Doesn't that mean that when they plug in to their own, poorly protected, home network they end up with a laptop open to the elements??

Sorry i probably should of re-worded that, when the staff take the laptops home they have to logon locally and the firewall is turned on and i just stop them via the local group policy turning it off.

[Nozza]

The reason I ask is that we get sporadic problems with firewalls suddenly losing the exception for the rmsmartcache client ident server which means workstation cannot access the net. I have to go around and add the exception. It occurs to me that the firewall is doing nothing of any use on a workstation sat behind adequate protection on the network.

[meastaugh1]

The reason I ask is that we get sporadic problems with firewalls suddenly losing the exception for the rmsmartcache client ident server which means workstation cannot access the net. I have to go around and add the exception. It occurs to me that the firewall is doing nothing of any use on a workstation sat behind adequate protection on the network.

You mentioned a firewalled and filtered internet connection, but what about attack/risk from inside the school?

[theriver]

The reason I ask is that we get sporadic problems with firewalls suddenly losing the exception for the rmsmartcache client ident server which means workstation cannot access the net. I have to go around and add the exception. It occurs to me that the firewall is doing nothing of any use on a workstation sat behind adequate protection on the network.

Hi. Do you manage the exception via Group Policy? This should be pretty reliable . . . .

And for info, we have all firewalls up all the time, to protect clients from each other.

[cookie_monster]

@ Nozza

As stated above

your perimeter firewall is useless if someone brings an infected laptop or USB drive in and plugs it into your network

[localzuk]

The reason I ask is that we get sporadic problems with firewalls suddenly losing the exception for the rmsmartcache client ident server which means workstation cannot access the net. I have to go around and add the exception. It occurs to me that the firewall is doing nothing of any use on a workstation sat behind adequate protection on the network.

You shouldn't be going around to any machines, it can and should be done via group policy. Adding a rule is a single line of text, and takes a few seconds.

[cookie_monster]

Deploying Windows Firewall Settings With Group Policy