Forum Discussion
DanWheeler
Apr 28, 2022Copper Contributor
Intune Firewall Policies Left Behind - Creation but No Deletion
I've been building out firewall policies for our device types and through some accidental experimentation, found that firewall policies never seem to be removed from the firewall once the Intune config is unassigned or changed. I have a couple examples of this:
In case #1, I created a firewall rule in Intune and first limited it to domain and private network profiles. This created a firewall rule as expected with "Domain, Private" shown in the profile column for the rule. I then found that this firewall rule was not working (unrelated problem) so I removed the Domain and Private checkboxes to make the rule apply to all network profiles. It's easier that way anyway since Windows sometimes gets confused about what type of network it's on (another unrelated but common issue) But now I have both sets of rules from the original and modified Intune policy:
In case #2, I had two firewall rule sets applied from Intune with identical RDP rules. I fixed the issue by unassigning the redundant Intune rule but the rule remained in the firewall config.
I'm just now discovering this so I could be missing something or not understanding how these firewall rules work but was wondering if anyone else could repro or has run into this?
thanks,
Dan
8 Replies
Sort By
- NT-DWCopper ContributorWe are observing the same issue. Firewall rules deployed from Intune are staying tattooed even after the rule is removed/out of scope for the device. Is this a known issue?
- I am explaining how you could check out if those firewall rules were removed as it should in this blog
https://call4cloud.nl/2020/07/the-windows-firewall-rises/#part7- DanWheelerCopper Contributor
Rudy_Ooms_MVP thanks, Rudy. I'm setting them through Endpoint Security > Microsoft Defender Firewall rules.
I assigned a test rule this morning, it synced to the firewall then I removed it but it's still in the firewall.
I'm using Windows 10 LTSC 1809. Wonder if this is an issue that was fixed in later builds?
Hi... So far as I know the tattoeing issue changed with version 1903...
Intune and the Device Configuration Profile Tattooing issue (call4cloud.nl)
So .... I guess ltsc 1903 isn't going to work
- Could you show "how" you created those firewall policies, as normally these shouldn't be tattooed
- NielsScheffersIron Contributor
I'm curious as well. Just tested it in my dev tentant and they follow changes as expected.