This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(243.2, 11%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGE%3C/text%3E%3C/svg%3E)
Hi MS Team,
There is GPO to disable to windows firewall but every time the server reboots, the server firewall keeps turns on automatically and set to enable.
Please advise.
Thanks,
GCE
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(182.40000000000003, 98%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESF%3C/text%3E%3C/svg%3E)
Were you able to solve your problem ? We are running into the same behavior, our policy is applied successfully on LTSC 2021 machines, but not on LTSC 2019 machines, this is maddening...
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(70.4, 10%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJM%3C/text%3E%3C/svg%3E)
We were able to solve this by preventing the Defender ActiveStore from enabling for the "DomainProfile". We still wanted the other profiles to be enabled for our servers, but for Domain, we needed it off because once we'd reboot, the ActiveStore Firewall would turn on regardless of any GPO and it would break network access to some of our applications.
I have no idea where I found this solution, but we implemented it a few years ago.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile
Value Name: EnableFirewall
Value type: (REG_DWORD)
Value Data: 0x0
This specifically stops the DomainProfile ActiveStore Firewall from starting: