Windows Server 2008 firewall. Inbound connection is blocked as outbound?

Question

I connect using "Computer Management" from computer A to computer B. Both computers are Windows Server 2008 x64 with all current hotfixes. The connection succeedes, and I don't even try to open any of the sub-snapins.
But computer A (the connection source) logs the following event in its System Log:
Log Name:      System
Source:        Microsoft-Windows-DistributedCOM
Date:          9/13/2008 8:59:58 PM
Event ID:      10006
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      <Computer A name's here>
Description:
DCOM got error "2147944122" from the computer <Computer B FQDN's here> when attempting to activate the server:
{03837521-098B-11D8-9414-505054503030}
And computer B (the connection destination) logs the following two events (three times each) in its Security Log:
Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          9/13/2008 9:00:11 PM
Event ID:      5152
Task Category: Filtering Platform Packet Drop
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      <Computer B name here>
Description:
The Windows Filtering Platform blocked a packet.
Application Information:
 Process ID:  568
 Application Name: \device\harddiskvolume1\windows\system32\services.exe
Network Information:
 Direction:  Inbound
 Source Address:  <Computer B IP's here>
 Source Port:  57144
 Destination Address: <Computer A IP's here>
 Destination Port:  63485
 Protocol:  6
Filter Information:
 Filter Run-Time ID: 0
 Layer Name:  Receive/Accept
 Layer Run-Time ID: 44
and
Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          9/13/2008 9:00:11 PM
Event ID:      5157
Task Category: Filtering Platform Connection
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      <Computer B name here>
Description:
The Windows Filtering Platform has blocked a connection.
Application Information:
 Process ID:  568
 Application Name: \device\harddiskvolume1\windows\system32\services.exe
Network Information:
 Direction:  Inbound
 Source Address:  <Computer B IP's here>
 Source Port:  57144
 Destination Address: <Computer A IP's here>
 Destination Port:  63485
 Protocol:  6
Filter Information:
 Filter Run-Time ID: 0
 Layer Name:  Receive/Accept
 Layer Run-Time ID: 44
Well, I already know that events 5152 and 5157 are nearly the same, so we need to look only into one of them in each case. But what's next?
It seems to me that the firewall here treats the initial connection and a responce as two different connection. So it allows the initial connection (from A to B) because I have some rules in place that are supposed to allow remote management. But then it blocks the responce (from B to A). In this case, looking into separate connection from B to A, I guess, it should treat it as outbound and not filter at all. But it still calls it "Inbound" for some reason, apply some firewall rules and blocks it.
Are my assumptions wrong? What are the explanation for this behaviour? How do I prevent the packets from being blocked?

Answer 1

Many thanks. That sounds almost logical.
Your statement regarding "no real reason to disable" is not exactly valid. There are myriad reasons to actually disable the service itself - one of which is other software that conflicts and sees the 'service' state, and not the 'profile state' of the firewall
settings. Those products - let me give you at least one as an example... wait for it... wait for it... The 'infamous' SQL Server!
Yes, pups and pupettes, that' is correct - SQL Server does indeed give you a "false positive" during its pre-req checks and so forth; and and tells you, "Oops, dear systems manager, your firewall service is still enabled... blah blah"  - that's not
the exact quote, but very close indeed. Does it bother to check and see that, "OH, well, you've got firewall disabled for ALL profiles, so all is cool?" Noooo, of course it doesn't. [Note to Microsoft, please fix this!]
Now, it may be okay [at this point], since I already have SQL server properly installed, and past all the "pre-checks," to re-enable the firewall service; but, to just off-hand say "there's NO reason whatsoever to disable the firewall service;" well, that
is just not correct.
For that matter, there are many of us who completely 'remove' the service - yes, it can be done - and, yes, I have written a technical article on doing just that; and, no, it will NOT cause unpredictable results - [IF] done properly and [IF] all the technical
whatcha-ma-jig-its are lined up with the North Star when Pluto is in retrograde.
But, yes, it is best just to let policy take care of disabling the various levels of the firewall and then leave the service as-is, since Microsoft puts more and more hooks in their o/s.
Thanks again.