# Ensure 'Windows Firewall: Public: Settings: Display a notification' is set to 'No'

Necessity: Disabling firewall notifications prevents end-users from making security decisions about network traffic, which they may not be qualified to make. When a user is prompted to allow an application through the firewall, they might inadvertently create a security vulnerability by permitting malicious or unnecessary connections. This is especially critical for the Public profile, which is active on untrusted networks like public Wi-Fi. Centralizing firewall rule management through policy rather than user prompts enforces a consistent and stronger security posture. Auditing and Remediation: The audit script checks the registry for the state of the 'DisableNotifications' setting for the Public firewall profile. The remediation script directly modifies this registry value to enable or disable the display of these notifications, aligning the system with the desired policy. Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is 'No'. There is no security benefit to displaying firewall notifications to end-users in a managed environment; it only introduces risk. Therefore, the most secure and recommended configuration is to disable them under all hardening scenarios to ensure that all firewall rules are managed centrally by administrators.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['No']` |
| **Moderate** | `['No']` |
| **Strict** | `['No']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the registry value 'DisableNotifications' at 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile'. The script must output 'No' if the value data is 1, and 'Yes' otherwise. The output should be exclusively the string 'Yes' or 'No'.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument ('Yes' or 'No'). If the argument is 'No', the script must set the registry value 'DisableNotifications' at 'HKLM:\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile' to a DWORD of 1. If the argument is 'Yes', it must set the value to 0. The script must create the key path if it does not exist and return `$true` upon successful configuration or `$false` if it fails.

