Do you have a configuration profile in place that might be keeping it on?

@tngo3 What are you expecting? It should just be turning stealth mode off so that the machine would respond to pings basically. You can read the preference to see if it's changing the value

defaults read /Library/Preferences/com.apple.alf stealthenabled

@roiegat This is one of the fun places where the binary trumps a config profile. The firewall and gatekeeper are the 2 frustrating places where this happens.