# Ensure 'Windows Firewall: Public: Settings: Apply local firewall rules' is set to 'No'

Necessity: This setting is critical for maintaining a consistent security posture in a centrally managed environment. When set to 'Yes', it allows local firewall rules created by a local administrator to be merged with the firewall rules deployed via Group Policy. This can create security gaps, as a local rule could override a central policy and open ports or allow traffic that is meant to be blocked, thereby increasing the system's attack surface. Setting this to 'No' ensures that only the centrally defined Group Policy firewall rules are enforced, preventing unauthorized and potentially insecure local modifications.

Auditing and Remediation: The audit script checks the 'AllowLocalPolicyMerge' registry value to determine if the system permits local firewall rules on the public profile. The remediation script directly modifies this registry value to enforce the desired state, ensuring that the centrally managed policy is not undermined by local changes.

Recommended State Rationale: 
- Basic: ['No'] is the fundamental recommended state. It enforces the principle of centralized management and prevents configuration drift, which is a common source of security vulnerabilities. 
- Moderate: ['No'] remains the recommendation as there is no secure middle ground. Allowing any local rule merge introduces an unacceptable level of risk for a moderately hardened system. 
- Strict: ['No'] is the only acceptable state for a strictly hardened system. Enforcing a single, authoritative policy source is non-negotiable for high-security environments. The binary nature of this control means that 'No' is the only secure option across all hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['No']` |
| **Moderate** | `['No']` |
| **Strict** | `['No']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to audit the 'Windows Firewall: Public: Settings: Apply local firewall rules' setting. The script must query the REG_DWORD value 'AllowLocalPolicyMerge' at the registry path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile'. It should interpret a value of 0 or the absence of the key as 'No' and a value of 1 as 'Yes'. The script must output only the resulting string ('Yes' or 'No') with no additional text or formatting.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument ('Yes' or 'No') to configure the 'Windows Firewall: Public: Settings: Apply local firewall rules'. The script must set the REG_DWORD value 'AllowLocalPolicyMerge' at 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile' to 0 if the argument is 'No', and to 1 if the argument is 'Yes'. The script must create the registry key path if it does not exist. It must return a boolean value: $true on success and $false on failure or if an invalid argument is provided.

