Firewall and Windows Update can not be closed in the OS deployed by MDT.
No joining into domain.
It said probably "Some settings are managed by the system administrator for the reason of security".
What settings should be made in the MDT to make Firewall and Windows Update modifiable?