# Ensure 'Windows Firewall: Public: Outbound connections' is set to 'Allow (default)'

The 'Outbound connections' setting for the Windows Defender Firewall determines the default behavior for all outgoing network traffic that does not match a specific firewall rule. The necessity of this setting lies in controlling data flow from the system to the network. A default 'Allow' policy is convenient but permits any application, including potential malware, to initiate connections, potentially leading to data exfiltration or communication with command-and-control servers. Conversely, a default 'Block' policy enforces a principle of least privilege, significantly reducing the attack surface by ensuring only explicitly approved applications can send data outbound. The audit script checks the current value of the 'DefaultOutboundAction' property for the Public profile. The remediation script directly modifies this property to either 'Allow' or 'Block'. The Basic state of 'Allow' is the Windows default for maximum compatibility. The Moderate and Strict states are set to 'Block', which is a security best practice recommended by frameworks like CIS. This configuration requires administrators to create explicit 'Allow' rules for necessary traffic, providing granular control and preventing unauthorized outbound communication.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Allow']` |
| **Moderate** | `['Block']` |
| **Strict** | `['Block']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the 'DefaultOutboundAction' for the 'Public' network profile using the `Get-NetFirewallProfile` cmdlet. The script must output only the current value (e.g., 'Allow' or 'Block') without any headers, labels, or additional text.

## Remediation Script Working

PowerShell script that uses the `Set-NetFirewallProfile` cmdlet to configure the 'DefaultOutboundAction' for the 'Public' network profile. The script must accept the desired state ('Allow' or 'Block') as a single positional command-line argument (`$args[0]`). It must return `$true` upon successful application of the setting and `$false` if an error occurs.

