Firewall - Cumulative or Overwrite? Multiple Firewall GPO's...

[Koldov]

Long story... (as short as I possibly can):

 

TL;DR

 

Do firewall rules set by GPO overwrite or are they cumulative..?

 

Short answer so far in my testing/research:

 

Cumulative if they are in the same OU.

 

Overwrite if they are from different OUs (in whatever precedence they have).

 

How to have 2 RDP firewall rules in separate OUs with different settings apply to one machine?

 

Long story... (as long as I possibly can):

 

I have a VM and for reasons too long (and possibly irrelevant) to go into in this post, I have been running it with the firewall off (I know).

 

Anyway, it niggled me so I turned it on and waited for the fallout (bearing in mind it runs WSUS and a print server)... but it never came.

 

Fast forward 2 weeks down the line and I'd forgotten all about it when the Headteacher walks in to my office and said he couldn't get on SIMS (as he uses a MAC I put Microsoft Remote Desktop on and pointed it to a VM - yes this VM as it has a SIMS client on it - limited VMs available).

 

It stumped me for a while and then I remembered I'd turned the firewall on!

 

Quick fix I turned the firewall off and RDP on the MAC connected... turned it back on and nada...

 

That's OK I thought, I'll just poke a hole in the firewall for his I.P. with a GPO for RDP... but as soon as I applied it my RDP session ended.

 

I have a GPO applied for the Domain with RDP settings for the firewall, set to my work PC I.P. and a another range for something else, but as soon as I apply this other GPO just to the VM (in a separate OU) it overwrites my Domain GPO settings. I don't want to add the MAC I.P. to a Domain wide RDP firewall hole!

 

So, how do I get this other I.P. to RDP through the firewall (without adding it to the Domain GPO) and stop it overwriting?

Edited February 2, 2023 by Koldov

[jthompson]

Could you use a copy of the domain-wide GPO as the basis for the VM-specific one, just adding into that copy the extra bits needed for the Mac? If the VM-specific GPO is overwriting the domain-wide one, at least it will include all the same settings as the domain-wide one.

 

Bit of a fudge, and I suspect that you ought to be able to have it set up cumulatively somehow. Not sure without playing.

[Koldov]

Apologies for the late response, but I've only just got a round to dealing with this because it reared its ugly head again as I've been messing around moving VMs and OUs about...

 

It seems to work so many thanks!