Forum Discussion

LilP77's avatar
LilP77
Copper Contributor
May 08, 2024

Defender Firewall rules - Event ID 2001

In my organization, we're moving away from Trellix suite to MDE. All of my policies (DLP, AV, Exclusions, etc...) are working, but not the Firewall general settings nor the Firewall Rules. Defender portal indicates that the Firewall settings policy was successful, but the rules are not. Our workstations are hybrid-joined, but managed by SCCM/MDE. When I look at the Event View for SENSE (channel Microsoft-Windows-SENSE/Operational) related events, I get an event ID 2001, and the info is: SenseCM: WRN: FW VA: no rule TESTING POLICY

 

The rule TESTING POLICY exists in my Defender portal, under Endpoint security policies, so it seems like my test workstation can see that policy, but it doesn't get applied, and also the Firewall settings don't get applied, as it doesn't appear to change the default block/allow for Outbound or Inbound for each of the Firewall profile (Public, Private, Domain).

 

Anything suggestion will be appreciated.

2 Replies

  • rahuljindal's avatar
    rahuljindal
    Bronze Contributor
    Since you mentioned hybrid, any chance the FW settings are coming from GPO?
    • LilP77's avatar
      LilP77
      Copper Contributor

      rahuljindal Good point. You gave me a good idea... I can't update the Group Policy from AD's side, but I will at least test with Local Group Policies.

Resources