# Ensure 'Windows Firewall: Private: Inbound connections' is set to 'Block (default)'

Necessity: The 'Inbound connections' setting for the firewall profile is a critical security control that dictates the default behavior for unsolicited network traffic. Setting this to 'Block' establishes a 'default-deny' posture, which is a fundamental principle of network security. This configuration ensures that only traffic for which an explicit 'allow' rule has been created can reach the system, effectively minimizing the attack surface. An incorrect configuration (e.g., 'Allow') would permit all inbound connections by default, exposing potentially vulnerable services to unauthorized access, malware propagation, and network-based attacks.

Auditing and Remediation: The audit script verifies the current state by reading the 'DefaultInboundAction' property of the 'Private' firewall profile. The remediation script directly modifies this same property, setting it to the value provided as a command-line argument, thus enforcing the desired security policy.

Recommended State Rationale: 
Basic, Moderate, and Strict: All three security levels recommend 'Block'. For this specific setting, there is no gradation of security; the only secure option is to block unsolicited inbound connections by default. This aligns with all major security benchmarks, including CIS. The 'Block' setting enforces the principle of least privilege on the network, which is non-negotiable for a secure system configuration. The alternative, 'Allow', is fundamentally insecure and is not recommended under any hardening standard.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Block']` |
| **Moderate** | `['Block']` |
| **Strict** | `['Block']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the configuration of the Windows Defender Firewall's 'Private' profile using the `Get-NetFirewallProfile` cmdlet. The script must be designed to return only the current value of the 'DefaultInboundAction' property, with no additional text or labels.

## Remediation Script Working

PowerShell script that uses the `Set-NetFirewallProfile` cmdlet to modify the 'DefaultInboundAction' for the 'Private' profile. The script must be configured to accept a single, positional command-line argument that specifies the desired state (e.g., 'Block'). The script must return `$true` if the configuration is successfully applied and `$false` if it fails.

