# Ensure 'Windows Firewall: Public: Outbound connections' is set to 'Allow (default)'

Necessity: This setting configures the default behavior for outbound network traffic on the Public profile, which is used on untrusted networks like public Wi-Fi. By default, Windows allows all outbound connections, which can permit malware or unauthorized software to exfiltrate data or communicate with command-and-control servers. Misconfiguring this setting by leaving it on 'Allow' in a high-security environment exposes the system to data leakage and external compromise. 

Auditing and Remediation: The audit script checks the current value of the 'DefaultOutboundAction' property for the Public firewall profile. The remediation script modifies this same property, changing the system's default outbound connection behavior to the value provided as an argument. 

Recommended State Rationale: 
- Basic: ['Allow'] represents the default Windows configuration. It prioritizes application compatibility over security, assuming all outbound traffic is legitimate. This is the minimum acceptable state for general-purpose workstations. 
- Moderate: ['Block'] implements a more secure 'deny by default' posture. This significantly enhances security by preventing any unauthorized application from initiating an outbound connection. It requires administrators to create explicit 'allow' rules for legitimate software, which is a security best practice. 
- Strict: ['Block'] is the most secure configuration possible for this setting. It is identical to the Moderate state and is recommended for high-security environments where all network traffic must be explicitly known and authorized, effectively preventing any form of unauthorized data exfiltration.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Allow']` |
| **Moderate** | `['Block']` |
| **Strict** | `['Block']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the 'DefaultOutboundAction' for the 'Public' network profile using the `Get-NetFirewallProfile` cmdlet. The script must output only the value of this property (e.g., 'Allow' or 'Block').

## Remediation Script Working

PowerShell script that accepts a single positional string argument (e.g., 'Allow', 'Block'). The script will use this argument to set the 'DefaultOutboundAction' for the 'Public' network profile via the `Set-NetFirewallProfile` cmdlet. The script must return `$true` on success and `$false` on failure.

