The Windows Firewall setting may change to "On (recommended)" when you perform an Automated System Recovery restoration of the operating system on a computer that is running Windows Server 2003 SP1 or that is running Windows Server 2003 R2

Consider the following scenario. You disable the Windows Firewall on a Microsoft computer that is running Microsoft Windows Server 2003 Service Pack 1 (SP1) or on a computer that is running Windows Server 2003 R2. Then, you use the NTBackup.exe tool to perform an Automated System Recovery (ASR) restoration of the operating system. In this scenario, the Windows Firewall settings may not be restored. For example, the Windows Firewall setting in Control Panel may change to On (recommended). Additionally, the Startup type setting for the Windows Firewall/Internet Connection Sharing (ICS) service in Computer Management may change to Automatic.

This problem occurs because ASR sets Windows Firewall settings to On (recommended) when it restores the operating system.

To work around this problem, use one of the following methods:

• Before you use the NTBackup.exe tool to perform an ASR restoration of the operating system, change the Startup type setting for the Windows Firewall/Internet Connection Sharing (ICS) service in Computer Management to Automatic.
• After you use the NTBackup.exe tool to perform an ASR restoration of the operating system, change the Windows Firewall setting in Control Panel to Off (not recommended).

When you install Windows Server 2003, the Windows Firewall setting in Control Panel is set to On (recommended). This is to help protect networks when security updates are downloaded after the Setup program is completed.

Additionally, when the Ntbackup.exe tool restores each service, it restores the service's settings or modifies the service's settings. The Ntbackup.exe tool does this based on the priority of the service's Startup Type setting. If a service's Startup Type setting is Automatic, it has a high priority. If a service's Startup Type setting is Manual, it has a medium priority. If a service's Startup Type setting is Disabled, it has a low priority. If the Startup Type setting for the Windows Firewall/Internet Connection Sharing (ICS) service is set to Disabled, it has a low priority and its settings are not restored. After the restoration process, its setting is set to Automatic.