# Ensure 'Windows Firewall: Public: Settings: Apply local firewall rules' is set to 'No'

Necessity: The 'Apply local firewall rules' setting determines if firewall rules defined by a local administrator are merged with the rules from Group Policy. The Public profile is used on untrusted networks (e.g., public Wi-Fi), where the device is at its highest risk. Disabling local firewall rules ('No') prevents users or applications from creating exceptions that could weaken the centrally-managed security policy, thereby reducing the attack surface. Allowing local rules ('Yes') on a public network could lead to inadvertent openings that malware could exploit.

Auditing and Remediation: The audit script checks the effective configuration by querying the relevant registry policy value to determine if local firewall rules are being applied. The remediation script directly modifies this registry value to enforce the desired policy, either allowing ('Yes') or blocking ('No') the merging of local rules with the Group Policy rules.

Recommended State Rationale: 
- Basic, Moderate, and Strict: The recommended state for all security levels is 'No'. Given that the Public profile is intended for high-risk, untrusted environments, there is no scenario where allowing local policy deviations is advisable from a security perspective. Enforcing a single, centrally-managed policy by setting this value to 'No' is a fundamental security practice to maintain a consistent and hardened security posture on potentially hostile networks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['No']` |
| **Moderate** | `['No']` |
| **Strict** | `['No']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to audit the 'AllowLocalPolicyMerge' setting for the Public firewall profile. The script should query the registry value at 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile\AllowLocalPolicyMerge'. If the value data is '0', the script must output 'No'. If the value data is '1' or if the registry value does not exist (as the default is 'Yes'), it must output 'Yes'. The script should return only the string 'Yes' or 'No'.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument: 'Yes' or 'No'. If the argument is 'No', the script must create and set the DWORD registry value 'AllowLocalPolicyMerge' at 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile' to '0'. If the argument is 'Yes', it must set the value to '1'. The script must ensure the registry path exists before setting the value. It must return '$true' on success and '$false' on failure.

