# Ensure 'Windows Firewall: Public: Settings: Apply local connection security rules' is set to 'No'

Necessity: This setting dictates whether local firewall rules can be merged with those deployed via Group Policy. Setting it to 'No' is critical for maintaining a centrally-managed, consistent security posture. When set to 'Yes', a local administrator or an application with sufficient privileges could create firewall rules that override or conflict with enterprise security policies, potentially opening ports and creating vulnerabilities. This is especially dangerous on the Public profile, which is used on untrusted networks where the attack surface should be minimized. Enforcing 'No' ensures that only administrator-defined Group Policy rules are active, preventing unauthorized exceptions.

Auditing and Remediation: The audit script checks the 'AllowLocalIPsecPolicyMerge' boolean property for the Public network profile and translates the output to the required 'Yes'/'No' format. The remediation script takes 'Yes' or 'No' as input, translates it into the appropriate boolean value ('$true' or '$false'), and applies it to the Public profile using the 'Set-NetFirewallProfile' cmdlet.

Recommended State Rationale: 
- Basic: Recommends 'No'. This is the standard best practice (e.g., per CIS Benchmarks) to ensure that centrally managed security policies are not undermined by local settings. It establishes a clear security hierarchy.
- Moderate: Recommends 'No'. As this is a binary security setting, there is no effective intermediate state. The only secure option is to prevent local rule merging.
- Strict: Recommends 'No'. For the highest level of security, the configuration must prevent any deviation from centrally-enforced policies. The 'No' setting is absolute and represents the most secure posture for this control.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['No']` |
| **Moderate** | `['No']` |
| **Strict** | `['No']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the 'Apply local connection security rules' setting for the Windows Defender Firewall's Public profile. The script must use the 'Get-NetFirewallProfile' cmdlet to check the 'AllowLocalIPsecPolicyMerge' property for the 'Public' profile and output only the string value 'Yes' if true or 'No' if false, with no extra text or labels.

## Remediation Script Working

PowerShell script that configures the 'Apply local connection security rules' setting for the Public firewall profile. The script must accept a single positional command-line argument ('Yes' or 'No'). It will use this argument to set the '-AllowLocalIPsecPolicyMerge' parameter for the 'Public' profile via the 'Set-NetFirewallProfile' cmdlet. The script must return the boolean value '$true' on success and '$false' on failure.

