I lied. While reading the rest of the thread, one more thing came to mind: Microsoft grants itself several exceptions in the firewall which are restored even if deleted by the user. Stuff like allow inbound any to cortana...