Firewall – How to disable group policy control over Windows Vista firewall

Just ran into this exact problem. Unidentified networks are by default set to type of "Public". This is awkward when you want Windows Firewall to be active on Public networks but not Private ones -- and your internal network is always "Unidentified".

What's an "Unidentified" network to Windows Server 2008?

The Network Lists service (netprofm) works with the Network Location Awareness service (nlasvc) to identify networks and find the associated saved settings for the network, if any. The NLA service will use a Default Gateway or SSID to identify a network, so if the NIC has neither a Default Gateway or associated SSID, then NLA will determine that the network is Unidentified.

You can however change the default -- so that so-called "Unidentified" networks will be defaulted to something other than Public:

1. Open Administrative Tools -> Local Security Policy.

2. Highlight the "Network List Manager Policies" item, then double click the "Unidentified Networks" on the right panel.

3. Set the "Location Type" to "Private" or "Public".

Worked for me!

This is a practice we used to partake in, on an AD domain with VPNs to multiple offices in multiple countries, and thought it was fine.

Until someone in a remote island office plugged a client's laptop into the network. Within 10 minutes, every office was infected with Conficker, we had to pull all internet connections and 3 engineers spent the best part of a week cleaning the worm out of all our systems (p.s. A/V at the time was Symantec, it wasn't for long after this).

Worms are less prevalent these days, however do you really need file and printer sharing ports open on your workstations? You'll need them on various servers, but that's where the beauty of GPO comes in. Default policy locks it down, add a policy object for the ports you need and apply only to the servers that really need it.

Whilst it's obvious that company policy should be no external laptops plugged into the domain (and it was), accidents happen, people bring viruses/worms in from visits etc. Better to be safe than very very sorry!