# Ensure 'Windows Firewall: Private: Outbound connections' is set to 'Allow (default)'

The 'Outbound connections' setting for the Windows Firewall determines the default behavior for all outgoing network traffic that does not have a specific rule. Setting this to 'Allow' provides usability, while 'Block' enforces a more secure, principle-of-least-privilege model. Controlling outbound traffic is a critical defense-in-depth strategy, as it can prevent malware from communicating with command-and-control servers, exfiltrating data, or downloading additional malicious payloads. The audit script checks the current default action for outbound connections on the Private profile, and the remediation script configures this setting. The Basic and Moderate recommendation of 'Allow' is the Windows default, prioritizing ease of use on trusted private networks. The Strict recommendation of 'Block' is for high-security environments; it denies all outbound traffic by default, requiring administrators to create explicit 'allow' rules for all necessary communications, thereby significantly reducing the system's attack surface and containment capabilities in the event of a compromise.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Allow']` |
| **Moderate** | `['Allow']` |
| **Strict** | `['Block']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the Windows Defender Firewall settings for the 'Private' profile using the 'Get-NetFirewallProfile' cmdlet and returns only the value of the 'DefaultOutboundAction' property.

## Remediation Script Working

PowerShell script that accepts a single string argument (e.g., 'Allow', 'Block'). The script must use this argument to set the '-DefaultOutboundAction' for the 'Private' network profile via the 'Set-NetFirewallProfile' cmdlet. The script must return '$true' upon successful execution and '$false' if it fails.

