A. Along with the new Windows Firewall in Windows 2003 SP1 and XP SP2, Microsoft provided an updated system.adm administrative template file that adds Group Policy settings that you can use to configure firewall behavior at a local machine policy level or by using an Active Directory (AD)-based Group Policy Object (GPO). To access the Windows Firewall Group Policy settings, open either a local machine policy (run gpedit.msc on a workstation) or a GPO stored in a domain. Expand Computer Configuration, Administrative Templates, Network, Network Connections, Windows Firewall. You can configure firewall settings under both the Domain Profile and Standard Profile subfolders. You use the domain profile when the computer is connected to the AD network and the standard profile when the machine isn't connected to the corporate network. This setup lets you configure different settings for networked machines and remote machines, as the figure shows. The options under each of the two branches are identical, and you can click an item to view its description. Here are some key settings you might want to enable:
- Windows Firewall: Protect all network connections. This setting essentially forces the firewall on or off for the profile.
- Windows Firewall: Do not allow exceptions. This option instructs the firewall to ignore any exceptions that have been defined. Enabling this setting is equivalent to selecting the "Don't allow exceptions" check box on the General tab of the Windows Firewall Control Panel applet.)
- Windows Firewall: Define program exceptions Properties. This setting lets you define custom programs, to which you can then grant exceptions to pass through the firewall.
- Windows Firewall: Prohibit notifications. This setting stops the firewall from prompting users whether they want to allow exceptions for a currently stopped program.
- Windows Firewall: Allow logging. This option lets you configure the logging level for the firewall, the log size, and its name and location.
