Ensure Windows Firewall is Enabled for All Network Types

Description:

Microsoft Defender Firewall (Windows Firewall) filters network traffic coming into and going out of the laptop based on rules. Windows uses three network profiles: Domain (company network joined to a domain), Private (trusted home or office network) and Public (cafes, airports, hotels and other untrusted networks). The firewall must be turned on for all three so the laptop is protected on any network it joins.

Rationale:

• Blocks unwanted and malicious inbound connections to the laptop

• Protects the laptop on untrusted public Wi-Fi networks

• Limits the spread of malware and worms across the network

• Meets compliance requirements for host-based firewalls (ISO 27001, SOC 2, PCI DSS, CIS Benchmarks)

Impact:

• Strong network protection with no change to normal user work

• Some apps that need incoming connections (for example local servers or file sharing) may need a firewall rule to work

• Blocked connection attempts can be logged for troubleshooting and investigation

• Turning the firewall off exposes the laptop to network attacks, especially on public networks

Default Value:

Windows Firewall is turned on by default for the Domain, Private and Public profiles. If a third-party firewall (such as Avast Premium Firewall) is turned on, Windows shows that product instead and turns its own firewall off.

Pre-requisites:

• Local Administrator rights

• Windows 10 or Windows 11

• The Windows Defender Firewall service (MpsSvc) running

• A list of business apps that need incoming connections, so rules can be added if needed

• No Intune or Group Policy setting that overrides the firewall on the device

Test Plan:

PowerShell:

1. Click Start and search for PowerShell.

2. Right-click Windows PowerShell and select Run as administrator.

3. Click Yes on the User Account Control prompt. The prompt shows PS C:\WINDOWS\system32> and the window title starts with Administrator:.

4. Check the firewall status for all three profiles:

5. Check which network profile is in use right now:

6. Expected result: Domain, Private and Public all show Enabled: True and DefaultInboundAction: Block (or NotConfigured, which also blocks by default). If not, follow the Implementation Plan.

Implementation Plan:

PowerShell:

1. Click Start and search for PowerShell.

2. Right-click Windows PowerShell and select Run as administrator.

3. Click Yes on the User Account Control prompt. 

         Get-Service -Name MpsSvc | Select-Object Name, Status, StartType

5. Turn on the firewall for all three profiles:

        Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True

6. Block inbound and allow outbound connections by default:

       Set-NetFirewallProfile -Profile Domain,Private,Public -DefaultInboundAction
        Block   -DefaultOutboundAction Allow

7. (Optional) Turn on logging of blocked connections:

8. Confirm the settings. All three profiles should show Enabled: True:

Backout Plan:

PowerShell:

1. Click Start and search for PowerShell.

2. Right-click Windows PowerShell and select Run as administrator.

3. Click Yes on the User Account Control prompt. The prompt shows PS C:\WINDOWS\system32> and the window title starts with Administrator:.

4. Turn off the firewall for one profile (change Private to the profile needed):

5. Or allow a single app through the firewall instead (change the path to your app):

       New-NetFirewallRule -DisplayName "Allow AppName" -Direction Inbound -Program "C:
        \Program   Files\AppName\App.exe" -Action Allow

6. Turn the firewall back on for all profiles when done:

        Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True

Reference:

• Windows Firewall overview

• Set-NetFirewallProfile (PowerShell)

• Get-NetFirewallProfile (PowerShell)