SOLVED
Home

Windows server 2019 Active Directory GPO's blocked by Windows 10 firewall when forced from the serve

%3CLINGO-SUB%20id%3D%22lingo-sub-321226%22%20slang%3D%22en-US%22%3EWindows%20server%202019%20Active%20Directory%20GPO's%20blocked%20by%20Windows%2010%20firewall%20when%20forced%20from%20the%20serve%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-321226%22%20slang%3D%22en-US%22%3E%3CP%3EI%20work%20in%20a%20small%20business%20and%20and%20I%20am%20the%26nbsp%3B%20part%20time%20server%20admin%20with%20not%20much%20experience.%26nbsp%3B%20We%20are%20migrating%20from%202008%20R2%20to%202019.%26nbsp%3B%20I%20have%20Windows%20Server%202019%20AD%20installed%20in%20a%20test%20environment%20with%20two%20Win%2010%20PCs.%26nbsp%3B%20Everything%20is%26nbsp%3Ba%20vanilla%20out%20of%20the%20box%20installation%20for%20both%20the%20server%20and%20clients.%26nbsp%3B%20Built%20my%20first%20GPO%20to%20test%26nbsp%3B%20Forcing%20an%20update%20of%20the%20GPO%20from%20the%20AD%20server%20failed.%26nbsp%3B%20Turned%20off%20the%20firewall%20for%20client%201%20and%20voila%2C%20the%20GPO%20was%20deployed%20when%20forced%20from%20the%20server.%26nbsp%3B%20%26nbsp%3BLater%20in%20the%20day%2C%20logged%20onto%20client%202%20and%20found%20that%20even%20though%20the%20force%20from%20the%20server%20did%20not%20work%20earlier%2C%20my%20GPO%20was%20deployed.%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIn%20my%26nbsp%3Bsearching%2C%20I%20found%20mentions%20of%20inbound%26nbsp%3BRPC%20rules%20that%20can%20be%20turned%20on%20at%20the%20client%20to%20allow%20forcing%20GPOs%20from%20the%20server.%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20just%20want%20to%20confirm%20that%20I%20am%20not%20missing%20something%20here.%26nbsp%3B%20My%20understanding%20from%20this%20is%20exercise%20is%3A%3C%2FP%3E%3CP%3E1.%26nbsp%3B%20standard%20GPO%20deployment%20is%20performed%20by%20the%20local%20client%20initiating%20the%20process%20at%20boot%20time%20for%20computer%20policies%20and%20when%20an%20user%20logs%20in%20for%20user%20policies%3C%2FP%3E%3CP%3E2.%26nbsp%3B%20If%20I%20want%20to%20be%20able%20to%20force%20updates%20from%20the%20server%2C%20then%20I%20will%20need%20to%20deploy%20firewall%20rules%20opening%20up%20the%20needed%20rpc%20ports%20on%20the%20client%20for%20the%20inbound%20traffic%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDo%20I%20have%20this%20right%3F%26nbsp%3B%20Thanks%20for%20any%20clarifications.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-321226%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EActive%20Directory%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-323821%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20server%202019%20Active%20Directory%20GPO's%20blocked%20by%20Windows%2010%20firewall%20when%20forced%20from%20the%20s%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-323821%22%20slang%3D%22en-US%22%3EYou%20are%20very%20welcome!%3CBR%20%2F%3EEd%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-323786%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20server%202019%20Active%20Directory%20GPO's%20blocked%20by%20Windows%2010%20firewall%20when%20forced%20from%20the%20s%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-323786%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20for%20the%20info%2C%20it%20was%20very%20helpful.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-323427%22%20slang%3D%22en-US%22%3ERe%3A%20Windows%20server%202019%20Active%20Directory%20GPO's%20blocked%20by%20Windows%2010%20firewall%20when%20forced%20from%20the%20s%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-323427%22%20slang%3D%22en-US%22%3E%3CP%3EThere%20are%20two%20separate%20issues%20here.%20Are%20the%20clients%20getting%20the%20GPOs%20and%20can%20you%20force%20a%20GPO%20update%20of%20the%20client%20from%20the%20server.%3C%2FP%3E%0A%3CP%3EThe%20clients%20should%20get%20the%20GPOs%20applied%20according%20to%20the%20normal%20GPO%20processing%20methodology%3A%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fblogs.technet.microsoft.com%2Fmusings_of_a_technical_tam%2F2012%2F02%2F13%2Fgroup-policy-basics-part-1-understanding-the-structure-of-a-group-policy-object%2F%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3EGroup%20Policy%20Basics%201%3C%2FA%3E%2C%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fblogs.technet.microsoft.com%2Fmusings_of_a_technical_tam%2F2012%2F02%2F15%2Fgroup-policy-basics-part-2-understanding-which-gpos-to-apply%2F%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3EGroup%20Policy%20Basics%202%3C%2FA%3E%2C%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fblogs.technet.microsoft.com%2Fmusings_of_a_technical_tam%2F2012%2F02%2F22%2Fgroup-policy-basics-part-3-how-clients-process-gpos%2F%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3EGroup%20Policy%20Basics%203%3C%2FA%3E%3C%2FP%3E%0A%3CP%3EAssuming%20the%20clients%20are%20getting%20the%20policies%20applied%20through%20the%20normal%20mechanisms%2C%20the%20second%20issue%20is%20whether%20or%20not%20you%20can%20force%20a%20GPO%20update%20from%20the%20server.%20In%20order%20to%20allow%20the%20Windows%2010%20workstation%20to%20receive%20the%20command%20from%20the%20server%2C%20Windows%20Remote%20Management%20needs%20to%20be%20enabled%20in%20the%20workstation%20(Windows%20Remote%20management%20is%20enabled%20by%20default%20in%20the%20server%20OS%20but%20not%20in%20the%20workstation%20OS).%3C%2FP%3E%0A%3CP%3EThe%20easiest%20way%20to%20do%20this%20is%20to%20create%20the%20starter%20GPOs%20in%20the%20Group%20Policy%20Management%20Console%20in%20the%20server.%20There%20is%20a%20starter%20GPO%20that%20enables%20remote%20management%20that%20you%20can%20link%20to%20the%20OU%20that%20contains%20the%20client%20systems.%20Allow%20that%20GPO%20to%20apply%20(or%20trigger%20it%20locally%20on%20the%20workstation)%20and%20then%20reboot%20the%20workstation.%20You%20should%20then%20be%20able%20to%20force%20additional%20GPO's%20to%20apply%20from%20the%20server.%3C%2FP%3E%0A%3CP%3EHope%20this%20helps.%3C%2FP%3E%0A%3CP%3EEd%20Gallagher%2C%20MVP%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
severt
New Contributor

I work in a small business and and I am the  part time server admin with not much experience.  We are migrating from 2008 R2 to 2019.  I have Windows Server 2019 AD installed in a test environment with two Win 10 PCs.  Everything is a vanilla out of the box installation for both the server and clients.  Built my first GPO to test  Forcing an update of the GPO from the AD server failed.  Turned off the firewall for client 1 and voila, the GPO was deployed when forced from the server.   Later in the day, logged onto client 2 and found that even though the force from the server did not work earlier, my GPO was deployed.  

 

In my searching, I found mentions of inbound RPC rules that can be turned on at the client to allow forcing GPOs from the server.  

 

I just want to confirm that I am not missing something here.  My understanding from this is exercise is:

1.  standard GPO deployment is performed by the local client initiating the process at boot time for computer policies and when an user logs in for user policies

2.  If I want to be able to force updates from the server, then I will need to deploy firewall rules opening up the needed rpc ports on the client for the inbound traffic

 

Do I have this right?  Thanks for any clarifications. 

 

3 Replies
Solution

There are two separate issues here. Are the clients getting the GPOs and can you force a GPO update of the client from the server.

The clients should get the GPOs applied according to the normal GPO processing methodology:

Group Policy Basics 1Group Policy Basics 2Group Policy Basics 3

Assuming the clients are getting the policies applied through the normal mechanisms, the second issue is whether or not you can force a GPO update from the server. In order to allow the Windows 10 workstation to receive the command from the server, Windows Remote Management needs to be enabled in the workstation (Windows Remote management is enabled by default in the server OS but not in the workstation OS).

The easiest way to do this is to create the starter GPOs in the Group Policy Management Console in the server. There is a starter GPO that enables remote management that you can link to the OU that contains the client systems. Allow that GPO to apply (or trigger it locally on the workstation) and then reboot the workstation. You should then be able to force additional GPO's to apply from the server.

Hope this helps.

Ed Gallagher, MVP

 

 

Related Conversations
Extentions Synchronization
Deleted in Discussions on
3 Replies
Tabs and Dark Mode
cjc2112 in Discussions on
38 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies