9.1.2 Ensure 'Windows Firewall: Domain: Inbound connections' is set to 'Block (default)'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This setting determines the behavior for inbound connections that do not match an inbound firewall rule.

The recommended state for this setting is: Block (default).

Rationale:

If the firewall allows all traffic to access the system then an attacker may be more easily able to remotely exploit a weakness in a network service.

Impact:

None - this is the default behavior.

Solution

To establish the recommended configuration via GP, set the following UI path to Block (default):

Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Domain Profile\Inbound connections

Default Value:

Block (default). (The Windows Firewall with Advanced Security will block all inbound connections that do not match an inbound firewall rule in this profile.)

See Also

https://workbench.cisecurity.org/files/3973