# Ensure 'Windows Firewall: Public: Firewall state' is set to 'On (recommended)'

The Windows Defender Firewall is a critical host-based firewall that protects the system from network-based threats. The 'Public' profile is the most restrictive and is used when connected to untrusted networks like public Wi-Fi. Enabling the firewall for this profile is essential to block unsolicited incoming traffic, which helps prevent malware propagation, port scanning, and unauthorized access attempts from potentially malicious actors on the same network. A disabled firewall on a public network leaves the system highly vulnerable. The audit script checks the 'Enabled' property of the 'Public' firewall profile to determine its current state. The remediation script directly sets this property to either enabled or disabled. For all security hardening levels (Basic, Moderate, and Strict), the recommended state is 'Enabled'. There is no secure justification for disabling the firewall when connected to a public, untrusted network; it represents the absolute baseline for network security.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script using the 'Get-NetFirewallProfile' cmdlet to query the firewall profile where the 'Name' attribute is 'Public'. The script must be designed to return only the current state as a string, which will be 'Enabled' if the firewall is on or 'Disabled' if it is off, with no extra text or labels.

## Remediation Script Working

PowerShell script that uses the 'Set-NetFirewallProfile' cmdlet to configure the firewall state for the 'Public' profile. The script must accept a single positional command-line argument: either 'Enabled' or 'Disabled'. It will apply this setting and must return the boolean value '$true' upon successful configuration or '$false' if an error occurs.

