Windows Defender Firewall with PowerShell: profiles, rules, and logging

Profiles first

Windows Defender Firewall has three profiles: Domain, Private, and Public. The active one depends on the network. Get-NetFirewallProfile shows whether each is enabled and its default inbound and outbound actions. All three should be enabled with default inbound Block.

A disabled profile is a frequent finding, often from troubleshooting that was never undone.

Snippet

Get-NetFirewallProfile | Select Name, Enabled, DefaultInboundAction, DefaultOutboundAction, LogBlocked, LogFileName
Get-NetConnectionProfile

Review inbound allow rules

List enabled inbound Allow rules with their ports and remote address scope. Rules with RemoteAddress Any for administrative services such as RDP, WinRM, or SMB are the ones to tighten. Applications often add their own rules at install time; review those too.

Set-NetFirewallRule changes scope without recreating rules, and New-NetFirewallRule creates targeted ones.

Snippet

Get-NetFirewallRule -Direction Inbound -Enabled True -Action Allow |
  ForEach-Object { $p=$_ | Get-NetFirewallPortFilter; $a=$_ | Get-NetFirewallAddressFilter
    [pscustomobject]@{Name=$_.DisplayName; Profile=$_.Profile; Port=$p.LocalPort; Remote=$a.RemoteAddress} } |
  Where-Object Port -in '3389','5985','5986','445' | Format-Table -AutoSize

Lab: scope and log

On a lab VM, restrict WinRM to the management subnet, enable logging of dropped packets for all profiles, then scan the VM from a host outside the subnet. Read the log at %SystemRoot%\System32\LogFiles\Firewall\pfirewall.log and find the dropped connections from your scanner.

The log is plain text with date, time, action, protocol, source, destination, and ports, easy to forward or parse.

Snippet

Set-NetFirewallRule -DisplayGroup 'Windows Remote Management' -RemoteAddress 192.168.56.0/28
Set-NetFirewallProfile -All -LogBlocked True -LogMaxSizeKilobytes 16384
Get-Content "$env:SystemRoot\System32\LogFiles\Firewall\pfirewall.log" -Tail 20

Manage by policy

In a domain, define firewall rules through Group Policy or Intune and disable local rule merging on servers so local changes cannot open ports. Event 2097 and related events in the Windows Firewall With Advanced Security log record rule changes.

Outbound filtering is harder to maintain but valuable on servers, where the set of legitimate destinations is small.

Diagram

Firewall review in four steps

Profiles
All enabled, default inbound Block.
Command
```
Get-NetFirewallProfile
```
Rules
List inbound allows for admin ports.
Scope
Restrict to management ranges.
Log
Enable dropped-packet logging and forward it.

Check yourself

1. Which cmdlet shows whether each firewall profile is enabled?

2. Which rule property limits which sources can connect?

3. Where is the firewall log written by default?