This message was deleted.

They aren't registering to a VIP are they? No proxy in the way? I know that the traffic to DDC is bidirectional, not sure if that matters.

Nope, the list is in registry - they are going directly to controllers

I would think throw wireshark on the VDA and make sure you aren't getting a reset packet from anywhere else, but that doesn't make much sense. I mean you only changed the GPO for windows firewall. Maybe make sure the NIC has the correct profile on it (domain or Private)

ok I retested and looks like the policy does break netconnection on 80 and 443. So perhaps the fw policy is not correctly structured. I was under impression that you could do allow and then deny all in that order but that is not working

Its been a minute on Windows Firewall for me, I would think so too, I know thats how a firewall appliance is gonna work, first rule it hits goes. Glad you found it!

not going to bother with GPO. Blocked with Azure nsg instead

Yea allow on top then deny on bottom I thought