How to turn off windows firewall for an entire domain

Ever since windows SP2 came out and microsoft has gotten security crazy (deploying security when it would be useless and not deploying it when you most need it) There has been the windows firewall.

On a large scale domain, the windows firewall can cause significant problems and is completely unnecessary. It can stop you from printing to network printers, stop your logon scripts from mapping network drives, and other things that will drive you crazy enough to pull out your hair.

What makes it worse is when you join windows XP to a windows 2003 server. By default, the domain controller strips away your ability to turn off the firewall and there is no easy solution to turn it off... that is untill now.

1) Locate Netfw.inf on your windows 2003 domain controller using the search utility.

2) To disable Windows Firewall on XP SP2 machines in a domain environment, add the following entries to the [ICF.AddReg.DomainProfile]

section of Netfw.inf :

HKLM,"SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile","DoNotAllowExceptions",0x00010001,0

HKLM,"SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile","EnableFirewall",0x00010001,0


What these entries do is to add the necessary registry keys to your XP SP2 machines to disable Windows Firewall when the machines belong to a domain.

Tip: It’s a good idea to leave the [ICF.AddReg.StandardProfile] unchanged so that the default firewall configuration for your machines when not joined to a domain is to have Windows Firewall enabled. This is especially true of machines like laptops that can be removed from the network.

NOTE: after applying the fix, you must log off the client computers and then log back on. In my tests, the firewall would still say that it was on and my options were still greyed out. The firewall was infact off. Promptly after applying the fix, i was able to scan the computer and did notice the ports were infact open.