# Ensure 'Windows Firewall: Private: Outbound connections' is set to 'Allow (default)'

Necessity: Configuring the default outbound connection behavior is a critical defense-in-depth security measure. While the default setting allows all outbound traffic, which is convenient, it also permits malware or compromised applications to freely communicate with external command-and-control servers, exfiltrate data, or download additional malicious payloads. Blocking outbound connections by default enforces a principle of least privilege, ensuring that only explicitly approved applications and services can communicate externally. This significantly reduces the attack surface and can contain a breach by preventing unauthorized network activity. Auditing and Remediation: The audit script checks the 'DefaultOutboundAction' property for the firewall's 'Private' profile using the `Get-NetFirewallProfile` cmdlet. The remediation script uses the `Set-NetFirewallProfile` cmdlet to modify this same property, changing the default behavior to either 'Allow' or 'Block'. Recommended State Rationale: Basic: The 'Allow' state is the default for Windows and represents the most basic level of security. It prioritizes usability and application compatibility over security, relying on other layers of defense to prevent malicious outbound traffic. Moderate & Strict: The 'Block' state represents a significantly hardened security posture recommended for both moderate and strict levels. By blocking all outbound connections by default, the system adopts a zero-trust approach to network traffic. This requires administrators to create specific 'allow' rules for legitimate applications, but it provides a powerful control to prevent data exfiltration and malware communications. This is a best practice for high-security environments, as it contains threats that have already penetrated initial defenses.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Allow']` |
| **Moderate** | `['Block']` |
| **Strict** | `['Block']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the 'DefaultOutboundAction' for the 'Private' profile of the Windows Defender Firewall. The script must only output the current value (e.g., 'Allow' or 'Block') and nothing else.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument to set the 'DefaultOutboundAction' for the 'Private' profile of the Windows Defender Firewall. The script must apply the setting and return `$true` on success or `$false` on failure.

