How to programmatically read Group Policy Firewall rules in a corporate domain?

Question

How to programmatically read Group Policy Firewall rules in a corporate domain?

Jack 5T 20

Hi everyone, I’m trying to programmatically retrieve the Windows Firewall rules applied via Group Policy using Win32 APIs in a corporate domain, but I’m completely stuck.

I tried calling GetGPOList() after grabbing a process token, but it keeps failing with error 2148074274, which I believe is tied to some Active Directory replication issue, though I don’t fully get why it's happening in our environment. Even if I manage to get past that error, I’m not entirely sure this API actually exposes the firewall policy data directly.

Is there a proper way to fetch GPO-based firewall settings, or am I going down the wrong rabbit hole?

0 comments

2 answers

Your answer

Answer 1

Windows Firewall rules that come from Group Policy are not exposed directly through GetGPOList or similar Win32 GPO-enumeration APIs. GetGPOList only tells which GPOs apply; it does not parse their Windows Firewall policy data.

To programmatically read the effective firewall configuration (including rules coming from domain GPOs) in a corporate domain, query the local policy store on a domain-joined machine using the Windows Firewall / IPsec management APIs or PowerShell cmdlets, rather than trying to read GPOs directly:

Use the Windows Firewall with Advanced Security policy store
- The effective rules on a client are the result of merging:
  - Domain GPOs
  - MDM/CSP policy (if present)
  - Local Group Policy
  - Local rules (if AllowLocalPolicyMerge is enabled for that profile)
- These are all surfaced through the Windows Firewall policy store on the machine. The same store is used by the MMC snap-in (wf.msc) and by the PowerShell cmdlets.
Enumerate rules via PowerShell (for reference / reverse‑engineering)
- On a domain-joined client where the GPOs are applied, run:
```
     Show-NetIPsecRule -PolicyStore ActiveStore
```
  This shows IPsec rules in the active policy store, including those from GPOs.
- To inspect a specific rule and see where it came from:
```
     Get-NetIPsecRule -DisplayName "Require Inbound Authentication" -TracePolicyStore
```
  This returns PolicyStoreSourceType = GroupPolicy and a PolicyStoreSource that identifies the GPO.
- Similar cmdlets exist for classic firewall rules (Get-NetFirewallRule, Show-NetFirewallRule) and use the same policy store model.
Programmatic approach (Win32 / COM)
- Instead of GetGPOList, use the Windows Firewall with Advanced Security COM interfaces (or the newer Net* APIs) that operate on the local policy store. These APIs read the merged policy that already includes domain GPO settings.
- Conceptually, this is equivalent to what the MMC snap-in does when it displays rules under Windows Firewall with Advanced Security on a domain-joined machine.
Be aware of rule merging behavior
- In high-security environments, administrators can disable local rule merging via the AllowLocalPolicyMerge settings for Domain/Private/Public profiles (through CSP or GPO). When disabled, only centrally deployed rules (GPO/MDM) are effective.
- Local Group Policy firewall rules are still applied even when merge from other local sources is disabled.
- When reading from the active policy store, the result already reflects these merge rules; no need to manually interpret GPOs.
If the goal is to know which GPO defined a rule
- Use the policy-store tracing behavior (as shown with -TracePolicyStore) as a model: query the rule from the active store, then inspect its policy store metadata to identify the source GPO.
- This avoids having to parse GPOs and their registry/policy files directly.

In summary, the correct rabbit hole is the Windows Firewall policy store (via firewall/IPsec APIs or the Net* cmdlets), not GetGPOList. GetGPOList is useful only to know which GPOs apply, not to read firewall rules themselves.

References:

Answer 2

Hey Jack,

You’re correct that GetGPOList() isn’t the right path for firewall rules. That API only enumerates which GPOs apply to a user or machine, not the actual policy data. The error you’re hitting (0x80092004 / 2148074274) is a cryptographic error usually tied to certificate chain validation, not AD replication, so it’s likely failing because the process token you’re using doesn’t have the right domain context or the machine can’t validate the DC’s certs.

If your goal is to programmatically read the firewall rules enforced by Group Policy, you need to query the effective policy after it’s processed by the local system. The supported way is through the Windows Firewall with Advanced Security APIs, specifically INetFwPolicy2 via COM, which exposes the active rules regardless of whether they came from local configuration or GPO. If you want to see the raw GPO data itself, you’d have to parse the registry under HKLM\Software\Policies\Microsoft\WindowsFirewall and its subkeys for Domain, Private, and Public profiles, since that’s where Group Policy writes firewall settings.

In practice, most enterprise tools rely on INetFwPolicy2 because it gives you the merged effective policy. If you need to track which GPO delivered which setting, you’d have to combine GetAppliedGPOList() with parsing the policy files in SYSVOL (Machine\Registry.pol) for each GPO, but that’s far more complex and not exposed by Win32 directly. For your use case, stick with INetFwPolicy2 to enumerate rules and profiles, and only drop down to registry parsing if you need the raw GPO source.

If the above response helps answer your question, please hit "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

Domic V.