# Ensure 'Windows Firewall: Private: Settings: Display a notification' is set to 'No'

Necessity: Displaying a firewall notification prompts the user to allow or block an application from receiving inbound connections. This delegates a critical security decision to the end-user, who may not be equipped to make the correct choice, potentially allowing malicious software to bypass firewall protections. Disabling this notification ensures that all firewall exceptions are managed by administrators according to a centrally-controlled policy, upholding the principle of least privilege and reducing the system's attack surface. Remediation and Auditing: The audit script checks the boolean value of the 'NotifyOnListen' property for the Private firewall profile. The remediation script sets this same property to true (for 'Yes') or false (for 'No') based on the input argument. Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is 'No'. This is a fundamental security control with no middle ground. Permitting user-level firewall modifications via notifications ('Yes') is inherently insecure in a managed environment. By setting the state to 'No', the organization enforces a consistent and administrator-defined security policy, preventing users from inadvertently creating vulnerabilities.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['No']` |
| **Moderate** | `['No']` |
| **Strict** | `['No']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the current state of the 'Windows Firewall: Private: Display a notification' setting. The script should query the Private profile's 'NotifyOnListen' property using the 'Get-NetFirewallProfile' cmdlet. The script must output only the string 'Yes' if notifications are enabled or 'No' if they are disabled, without any additional text or labels.

## Remediation Script Working

PowerShell script to configure the 'Windows Firewall: Private: Display a notification' setting. The script must accept a single positional command-line argument: 'Yes' or 'No'. It should use the 'Set-NetFirewallProfile' cmdlet to update the 'NotifyOnListen' property of the Private profile accordingly. The script must return the boolean '$true' on success and '$false' on failure or if the input is invalid.

