Aptora

Prior to Windows Vista and Windows Server 2008, network-based security configuration tasks such as managing Windows Firewall or IPsec policy could be accomplished using Group Policy, but with each using separate user interfaces to accomplish the tasks. Now Group Policy has been improved to provide a much better, unified UI for managing these settings, allowing you to create server and domain isolation rules with more clarity. You can find this UI under Computer Configuration\Windows Settings\Security Settings\Windows Firewall With Advanced Security. It combines management of Windows Firewall rules with creation of IPsec policy to allow for a more complete end-to-end network security management capability.

In addition, the new Windows Firewall provides a new profile categorization system from earlier versions. Windows Firewall in Windows Vista and Windows Server 2008 now includes the following three different profiles:

■ Domain Profile: This profile applies when the computer is connected to the network where its Active Directory computer account resides.

■ Private Profile: This profile applies when the computer is on a network that a local administrator designates as private.

■ Public Profile: This profile applies to all networks that are not covered by the domain or private profiles, including all networks that have not yet been classified.

You can use Group Policy to configure different levels of firewall restrictions based on which profile the computer is currently working in. Note that these policies are under the Computer Configuration section within Group Policy—this means, of course, that they will apply to computer accounts only. When the policy is delivered to the computer, all profiles as defined are stored with the computer and, as network conditions change, the appropriate profile becomes active. This allows the computer to receive firewall instructions during Group Policy processing and not have to be in contact with a domain controller as the computer moves from network to network. As network state changes, the network is evaluated as being domain, private, or public and the appropriate profile is activated.