{"id":490,"date":"2022-11-18T21:19:42","date_gmt":"2022-11-18T21:19:42","guid":{"rendered":"https:\/\/merserver.com\/?p=490"},"modified":"2022-11-18T21:19:48","modified_gmt":"2022-11-18T21:19:48","slug":"why-is-there-a-deny-rule-for-remote-desktop-in-windows-firewall-with-advanced-security","status":"publish","type":"post","link":"https:\/\/merserver.com\/index.php\/2022\/11\/18\/why-is-there-a-deny-rule-for-remote-desktop-in-windows-firewall-with-advanced-security\/","title":{"rendered":"Why is there a DENY rule for Remote Desktop in Windows Firewall with Advanced Security?"},"content":{"rendered":"\n

So this was a weird one. Remote desktop stopped working on client machines. Troubleshooting led to a group policy Block rule in the Windows firewall but there was no such GPO setting.<\/p>\n\n\n\n

TLDR:<\/strong> Don\u2019t put any spaces in the IP address list for the GPO setting for Computer\/Admin Templates\/Network\/Network Connections\/Windows Firewall\/Domain Profile\/Windows Firewall: Allow inbound Remote Desktop exceptions<\/em>.<\/p>\n\n\n\n

After adding a subnet to the \u201cWindows Firewall: Allow inbound Remote Desktop exceptions\u201d Remote Desktop stopped working.<\/p>\n\n\n\n

This is the policy\u2026<\/p>\n\n\n\n

<\/a><\/p>\n\n\n\n

Windows Firewall GPO Setting<\/p>\n\n\n\n

And this is the setting applied adding a second subnet into the Allow unsolicited incoming messages from these IP addresses<\/em>\u2026<\/p>\n\n\n\n

<\/a><\/p>\n\n\n\n

Windows Firewall Setting<\/p>\n\n\n\n

After troubleshooting I found the cause was the firewall rule on the local machine was now set to \u201cBlock\u201d.<\/p>\n\n\n\n

<\/a><\/p>\n\n\n\n

Windows Firewall Incorrect Setting<\/p>\n\n\n\n

The rule couldn\u2019t be deleted because this rule has been applied by the system administrator and cannot be modified<\/em>. In other words it was set by a GPO.<\/p>\n\n\n\n

The group policy results tool showed no block rules for remote desktop and only the Allow inbound Remote Desktop exceptions<\/em> shown above.<\/em> After trying all the common sense tests I removed the second IP address from the policy\u2026 and after a GPUPDATE the firewall rule changed back to Allow\u2026.<\/p>\n\n\n\n

<\/a><\/p>\n\n\n\n

Windows Firewall Correct Setting<\/p>\n\n\n\n

This was unexpected\u2026. so  I added the second address in again and the rule changed back to \u201cBlock\u201d.<\/p>\n\n\n\n

As a further test I changed the rule to an allow all \u201c*\u201d which also worked correctly setting the rule to \u201cAllow\u201d.<\/p>\n\n\n\n

On a hunch I added both subnets back in and removed the \u201cgood formatting\u201d space between them\u2026 and the rule worked properly and set to allow.<\/p>\n\n\n\n

<\/a><\/p>\n\n\n\n

Windows Firewall Working Settings<\/p>\n\n\n\n

So adding a space into the Allow unsolicited incoming messages from these IP addresses <\/em>converts the policy from Allow to Block. Weird.<\/p>\n\n\n\n

Works!<\/td>Doesn\u2019t Work.<\/td><\/tr>
\"Windows<\/td>\"Windows<\/td><\/tr><\/tbody><\/table><\/figure>\n","protected":false},"excerpt":{"rendered":"

So this was a weird one. Remote desktop stopped working on client machines. Troubleshooting led to a group policy Block rule in the Windows firewall but there was no such GPO setting. TLDR: Don\u2019t put any spaces in the IP address list for the GPO setting for Computer\/Admin Templates\/Network\/Network Connections\/Windows Firewall\/Domain Profile\/Windows Firewall: Allow inbound Remote Desktop…<\/p>\n

Read More “Why is there a DENY rule for Remote Desktop in Windows Firewall with Advanced Security?”<\/span> »<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-490","post","type-post","status-publish","format-standard","hentry","category-it"],"_links":{"self":[{"href":"https:\/\/merserver.com\/index.php\/wp-json\/wp\/v2\/posts\/490","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merserver.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merserver.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merserver.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merserver.com\/index.php\/wp-json\/wp\/v2\/comments?post=490"}],"version-history":[{"count":1,"href":"https:\/\/merserver.com\/index.php\/wp-json\/wp\/v2\/posts\/490\/revisions"}],"predecessor-version":[{"id":497,"href":"https:\/\/merserver.com\/index.php\/wp-json\/wp\/v2\/posts\/490\/revisions\/497"}],"wp:attachment":[{"href":"https:\/\/merserver.com\/index.php\/wp-json\/wp\/v2\/media?parent=490"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merserver.com\/index.php\/wp-json\/wp\/v2\/categories?post=490"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merserver.com\/index.php\/wp-json\/wp\/v2\/tags?post=490"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}