Is it alright to turn off firewall in a LAN using Group Policy?

Question

Is it a good idea or common practice to completely turn off windows firewall in an AD domain using Group Policy? At this time, even the servers' firewall are turned off. The only device not affected is the WAN facing router/firewall.

Answer 1

This is a practice we used to partake in, on an AD domain with VPNs to multiple offices in multiple countries, and thought it was fine.

Until someone in a remote island office plugged a client's laptop into the network. Within 10 minutes, every office was infected with Conficker, we had to pull all internet connections and 3 engineers spent the best part of a week cleaning the worm out of all our systems (p.s. A/V at the time was Symantec, it wasn't for long after this).

Worms are less prevalent these days, however do you really need file and printer sharing ports open on your workstations? You'll need them on various servers, but that's where the beauty of GPO comes in. Default policy locks it down, add a policy object for the ports you need and apply only to the servers that really need it.

Whilst it's obvious that company policy should be no external laptops plugged into the domain (and it was), accidents happen, people bring viruses/worms in from visits etc. Better to be safe than very very sorry!

Answer 2

I used to disable the firewall via GPO but no longer do so since an incident involving a compromised machine being plugged into my network. Although the firewall can be a real nuisance at times, as mentioned by Massimo, I believe it's preferable to apply appropriate rules rather than disable it completely. These days there are far too many threats coming from far too many sources and the extra layer of protection is welcome.

Answer 3

One solid strategy to secure a network is the idea of "defense in depth". What that means is establishing multiple layers of defenses to protect the network assets and information. At the dawn of the internet we didn't even have firewalls. Today we have a perimeter firewall, workstation firewalls, anti-malware, anti-spam, we restrict outbound ports and ensure all software is kept up-to-date.

Defense in-depth allows for the failure of any one component while still maintaining protection of the environment.

That said, when you have multiple layers, if you need to make a tactical decision to remove the firewall from a troublesome box, or disable real-time malware scanning for a particular machine, you will still have the other layers to protect you.

Answer 4

This question doesn't have a definitive answer in that it depends on your circumstances, so it can be business specific.

In general it's bad practice to shut it off completely. The more layers of security you have in place that won't interfere with your users productivity or your ability to manage the system, the better. And the firewall is virtually invisible to your users, so it's a good thing.

That said, we turn it off internally in our organization. The key is to have a way to mitigate the threat that comes with not having the firewall in place. We have hundreds of systems but they're running Deep Freeze; an infection on the network will be purged by shutting down all the computers at once since Deep Freeze will reset them to a pre-infection state, and if the user has a profile there is malware/virus detection on the server that can run and clean them out.

But this can fail, as an example in the answers points out. AV and Anti-Malware that relies on signatures are a band aid solution; there's always an arms race and you risk not having a cure in place before the infection.

That said, you're asking this, so you must have a reason for it. And more to the point you're being specific in that you want to shut it down via group policy. So...are you asking about having the firewall in place, or the method of shutting it down? If you're asking about how to shut it down, yes, shut it down with group policy. If you're asking whether it's good to shut down the firewall, you're getting plenty of answers on that :-)

(To note, we shut it down because it was a pain in the @#% when we needed to remotely work on people's systems, and the Windows firewall was interfering with certain applications. Using Deep Freeze mitigated about 85% of the risk of fast moving infections within our internal network, and yes, we've engaged in combat against a worm within the network before due to the lack of firewall and found that we still managed okay due to what we have in place. Keeping systems patched also help mitigate the risk.)