I have the following GPO applied to an OU containing our workstations:

Computer Configuration (Enabled)hide
Policieshide
Windows Settingshide
Security Settingshide
Windows Firewall with Advanced Securityhide
Global Settingshide
Policy Setting
Policy version Not Configured
Disable stateful FTP Not Configured
Disable stateful PPTP Not Configured
IPsec exempt Not Configured
IPsec through NAT Not Configured
Preshared key encoding Not Configured
SA idle time Not Configured
Strong CRL check Not Configured

Domain Profile Settingshide
Policy Setting
Firewall state Off
Inbound connections Not Configured
Outbound connections Not Configured
Apply local firewall rules Not Configured
Apply local connection security rules Not Configured
Display notifications Not Configured
Allow unicast responses Not Configured
Log dropped packets Not Configured
Log successful connections Not Configured
Log file path Not Configured
Log file maximum size (KB) Not Configured

Connection Security Settingshide
Administrative Templateshide
Policy definitions (ADMX files) retrieved from the local
machine.Network/Network Connections/Windows Firewall/Domain Profilehide
Policy Setting Comment
Windows Firewall: Protect all network connections Disabled

Network/Network Connections/Windows Firewall/Standard Profilehide
Policy Setting Comment
Windows Firewall: Protect all network connections Enabled

System/Logonhide
Policy Setting Comment
Always wait for the network at computer startup and logon Enabled

User Configuration (Enabled)hide
No settings defined.


What we're seeing is that on many workstations the XP firewall remains
on when they are booted up on the domain, until you run "gpupdate
/force" at which point the firewall switches off.

If you run "gpresult" before running the gpupdate /force Windows shows
the GPO as being applied.

Does anyone have any suggestions please?

We have what I would consider to be a normal, flat network, single
subnet with a 2003 R2 DHCP server i.e. nothing unusual to my mind.

Thanks in advance.