Windows Server 2022 — Firewall baseline GPO blocks SMB and admin shares — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution — Primary Fix
7. Solution — Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Remote administration, file copies, and backup agents fail after security baseline deployment.

Environment & Reproduction

Windows Server 2022 build 20348 with domain GPO replacing local firewall policy.

Get-NetFirewallProfile
Test-NetConnection server01 -Port 445
gpresult /r

Root Cause Analysis

Inbound SMB rules disabled or overridden by higher-precedence GPO with restrictive defaults.

Quick Triage

Check effective rules and active profile.

Get-NetConnectionProfile
Get-NetFirewallRule -DisplayGroup 'File and Printer Sharing' | Select DisplayName,Enabled,Profile,Action

Step-by-Step Diagnosis

Confirm rule precedence and identify policy source GPO.

Get-NetFirewallRule -PolicyStore ActiveStore | Where-Object DisplayName -match 'SMB|File and Printer'
Get-WinEvent -LogName 'Microsoft-Windows-Windows Firewall With Advanced Security/Firewall' -MaxEvents 100

Solution — Primary Fix

Enable required SMB rules in domain profile and reapply policy.

Enable-NetFirewallRule -DisplayGroup 'File and Printer Sharing'
Set-NetFirewallRule -DisplayGroup 'File and Printer Sharing' -Profile Domain -Action Allow
gpupdate /force

Solution — Alternative Approaches

Create narrow allow rules for management subnet only.

New-NetFirewallRule -DisplayName 'Allow SMB from Mgmt' -Direction Inbound -Protocol TCP -LocalPort 445 -RemoteAddress 10.10.0.0/16 -Action Allow -Profile Domain

Verification & Acceptance Criteria

SMB connectivity and remote admin commands should succeed.

Test-NetConnection server01 -Port 445
Get-SmbSession
Invoke-Command -ComputerName server01 -ScriptBlock { hostname }

Rollback Plan

If unexpected exposure occurs, disable temporary custom rule and restore prior GPO link order.

Disable-NetFirewallRule -DisplayName 'Allow SMB from Mgmt'
# Revert GPO link precedence in GPMC

Prevention & Hardening

Test firewall GPOs in staging OU with representative workloads.

Get-GPOReport -All -ReportType Html -Path C:Tempgpo-firewall.html
Get-NetFirewallRule -PolicyStore ActiveStore | Measure-Object

Related Errors & Cross-Refs

Correlates with WinRM and RPC management failures after hardening changes.

Related tutorial: View the step-by-step tutorial for Windows Server 2022.

View all Windows Server 2022 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn Windows Defender Firewall policy deployment on Windows Server 2022.