Forum Discussion

DanWheeler's avatar
DanWheeler
Brass Contributor
Apr 28, 2022

Intune Firewall Policies Left Behind - Creation but No Deletion

I've been building out firewall policies for our device types and through some accidental experimentation, found that firewall policies never seem to be removed from the firewall once the Intune conf...
Intune
DanWheeler's avatar
DanWheeler
Brass Contributor
May 02, 2022

Rudy_Ooms_MVP thanks, Rudy. I'm setting them through Endpoint Security > Microsoft Defender Firewall rules.

I assigned a test rule this morning, it synced to the firewall then I removed it but it's still in the firewall.

I'm using Windows 10 LTSC 1809. Wonder if this is an issue that was fixed in later builds?

 

 

    • ghostwriter_82hotmailcom's avatar
      ghostwriter_82hotmailcom
      Copper Contributor
      May 09, 2024
      Found this because I ran into the same problem. The test machine is a Windows 11 23H2.
      Created a test rule to block Firefox outbound traffic. It worked.
      Changed the rule to allow and it did what it was supposed to.
      Deleted the rule from Intune, it's still tattooed in the Defender firewall.
      Possible something else changed? this is going to make it a bit more difficult to test rules before deploying them to production.

      • AndreasWiesinger's avatar
        AndreasWiesinger
        Copper Contributor
        May 12, 2025

        It's the same for me and I'm on Windows 11 24H2.

        Created rule to allow RDP from all networks and then deleted the rule from Intune but it stayed on the device :(
        Later I created a another allow RDP rule but only from certain remote networks. Now both are on the device and it still works from any network. 
        At least for the test device I can workaround it, be deleting the corresponding regkeys under Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\FirewallRules

Resources