# Ensure 'Windows Firewall: Public: Settings: Apply local connection security rules' is set to 'No'

Necessity: This setting determines whether local connection security rules (IPsec) can be applied while the machine is on a public network. When connected to an untrusted public network, it is critical that the device strictly adheres to centrally managed security policies (e.g., from a domain GPO). Allowing local rules could enable a user or local process to create a less secure rule that overrides the centrally-defined policy, potentially creating security vulnerabilities. Disabling this feature ensures a consistent and predictable security posture enforced by administrators, mitigating the risk of unauthorized or insecure connections.

Auditing and Remediation: The audit script inspects the 'AllowLocalIPsecPolicy' registry value for the public firewall profile to determine its current state. The remediation script directly modifies this registry value to either allow ('Yes') or disallow ('No') the application of local connection security rules, aligning the system with the desired security policy.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict is 'No'. This is a binary choice with a clear security imperative. On a public network, which is inherently untrusted, the system's connection security should be exclusively managed by central policies to prevent misconfigurations or local overrides that could expose the system. There is no security benefit to a more permissive state; therefore, the most secure configuration ('No') is recommended for all hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['No']` |
| **Moderate** | `['No']` |
| **Strict** | `['No']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the current setting for 'Windows Firewall: Public: Settings: Apply local connection security rules'. The script must check the DWORD value 'AllowLocalIPsecPolicy' at the registry path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile'. It should output the string 'No' if the value is 0. If the value is 1 or does not exist (as the default is 'Yes'), it should output 'Yes'. The script must not return any other text, labels, or formatting.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument, which will be either 'Yes' or 'No'. The script will map 'No' to a DWORD value of 0 and 'Yes' to a DWORD value of 1. It must then set this value for 'AllowLocalIPsecPolicy' at the registry path 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile', creating the key if it does not exist. The script must return the boolean value $true on success and $false on failure.

