port exceptions from group policy need to be confirmed again andagain

Every once in a while, forefront pops up claiming to have detected
chenges in the computer configuration. I then have the opportunity to
accept or decline these.
It always turns out thet the "changes" are no changes at all and that
they have been approved by the administrator before, namely:
In an applicable group policy, under
Computer configuration - Administrative - Network - Windows Firewall -
Domain profile
the configuration
Windows firewallort exceptions
is activated and configured.

It is the ports configured here that keep popping up at the client.

How can I tell forefront to ignore such port exceptions when they come
from a policy?
Or: How can I globally accept these port exceptions in forefront? I
have found only the corresponding setting for applications, not for
ports.

Thanks in advance
hagman