Windows Firewall settings

I'm trying to configure the Windows Firewall/Internet Connection Sharing
(ICS) settings. There is a table of ports which has some entries and none of
them are checked. But if I build an image there are a number of things
enabled in the Firewall settings on the target that appear to not be turned
on in these settings. How do I find out what is overriding the ICS settings?
Thanks!