Security

Such work via the GPO would have been in the classes and certifications we expect the IT staff or leads to have. Even if such staff didn't have the training they would have the phone to pick up and call up Microsoft's own support.

You mention not breaking the bank but all this is part of the normal cost of managing the company assets so is there some back story such as this company is trying to go without the usual IT staff or didn't want to pay the usual cost of support? Also, I worry that this IT isn't doing the usual research but posting on the web without trying on their own or better yet, asking the management to pay and send them to the classes on this system.

Is your company that cheap?

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-deployment-guide

Remember that I take it that you have good, well trained IT staff. This section of the docs should be all they need.