# Ensure 'Windows Firewall: Public: Firewall state' is set to 'On (recommended)'

Necessity: The Windows Defender Firewall is a critical first line of defense against network-based threats. The 'Public' profile is activated when the computer is connected to untrusted networks, such as public Wi-Fi hotspots in airports or cafes. On these networks, the risk of encountering malicious actors and automated attacks (like network scanning and worms) is significantly higher. Ensuring the firewall is active for the Public profile blocks unsolicited incoming connections, preventing unauthorized access and mitigating a wide range of network attacks. Disabling it would expose the system's services directly to a hostile environment. Auditing and Remediation: The audit script checks the 'Enabled' property of the 'Public' firewall profile via the Get-NetFirewallProfile cmdlet, translating the boolean output to 'On' or 'Off'. The remediation script uses the Set-NetFirewallProfile cmdlet to modify this same property, taking 'On' or 'Off' as input to enable or disable the firewall for that profile. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict security levels is uniformly 'On'. This is a non-negotiable, foundational security setting. The Public profile implies an untrusted environment where the firewall is the primary perimeter defense. There is no scenario in a hardened security posture where disabling the firewall on a public network is acceptable. Therefore, the only recommended configuration is 'On' across all levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['On']` |
| **Moderate** | `['On']` |
| **Strict** | `['On']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the status of the Windows Defender Firewall for the 'Public' profile. The script must return only the current state as a string, either 'On' or 'Off', based on the 'Enabled' property, with no extra text or formatting.

## Remediation Script Working

PowerShell script that sets the state of the Windows Defender Firewall for the 'Public' profile. The script must accept one positional command-line argument: the desired state as a string ('On' or 'Off'). The script must return $true on success and $false on failure.

