Skip to content

Commit 5322e40

Browse files
committed
GPO rule merging issue
Added explanation of GPO merging issue
1 parent 7595107 commit 5322e40

File tree

5 files changed

+13
-0
lines changed

5 files changed

+13
-0
lines changed

ADDS/README.md

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -235,6 +235,19 @@ The resulting firewall rule set, which will be honored by the DCs, will contain
235235
236236
![GPO precedence](../Images/Screenshots/firewall-precedence-gpo.png)
237237

238+
Contrary to the standard GPO merging mentioned above, there's unexpected interaction, where the rules merging is not additive but rather the winning GPO rule overwrites the rule with lower precedence.
239+
This only happens, when the same rule (with different values) is created from "Predefined" rules in the new rule creation wizard.
240+
241+
![Predefined firewall rule](../Images/Screenshots/firewall-predefined-rules.png)
242+
243+
Consider 2 GPOs, each containing 3 rules with the same name, defining different set or remote IP address in the rule.
244+
Rules created through copy/paste or through new rule creation wizard, using "Custom" option, merge as expected, resulting in 4 rules in the target configuration (2 rules from each GPO).
245+
Rule created through new rule creation wizard, using "Predefined" option results in 1 rule in the target configuration, as the GPO with higher preference overwrites any other GPO configuring the same rule.
246+
247+
![GPO firewall example 01](../Images/Screenshots/firewall-gpo01.png)
248+
![GPO firewall example 02](../Images/Screenshots/firewall-gpo02.png)
249+
![GPO firewall merge result](../Images/Screenshots/firewall-rulemerge-result.png)
250+
238251
### Identifying Management Traffic
239252

240253
#### Motivation
10.7 KB
Loading
8.58 KB
Loading
21.3 KB
Loading
29 KB
Loading

0 commit comments

Comments
 (0)