# Ensure 'Windows Firewall: Private: Firewall state' is set to 'On (recommended)'

The Windows Defender Firewall is a critical, host-based, stateful firewall that forms the first line of defense against network-based threats. For the 'Private' profile, which applies to trusted networks like a home or office LAN, it is essential to keep the firewall active. Disabling it exposes the system to potential attacks from other compromised devices on the same 'trusted' network, allowing threats like worms or unauthorized remote access to propagate. The audit script verifies the 'Enabled' property of the 'Private' profile using the Get-NetFirewallProfile cmdlet. The remediation script uses the Set-NetFirewallProfile cmdlet to change this state. The recommended state for Basic, Moderate, and Strict levels is uniformly 'On' because there is no secure alternative; the firewall must be enabled to provide any protection. Disabling it, even temporarily, creates an unacceptable security gap, making 'On' the only valid recommendation for any security posture.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['On']` |
| **Moderate** | `['On']` |
| **Strict** | `['On']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the status of the Windows Defender Firewall for the 'Private' profile. The script should retrieve the current state and output only the string 'On' if the firewall is enabled or 'Off' if it is disabled, with no additional text or formatting.

## Remediation Script Working

PowerShell script that configures the Windows Defender Firewall state for the 'Private' profile. The script must accept a single positional command-line argument: 'On' or 'Off'. It must apply the specified setting and output `$true` upon successful configuration or `$false` if the operation fails.

