# Ensure 'Windows Firewall: Private: Inbound connections' is set to 'Block (default)'

Necessity: The 'Inbound connections' setting determines the default behavior for unsolicited incoming network traffic. Setting this to 'Block' is a fundamental security practice known as 'default-deny'. This posture ensures that the firewall drops all incoming traffic that does not correspond to an established connection or a specific 'allow' rule. Misconfiguring this to 'Allow' would expose the system to significant risks from other devices on the same private network, such as malware propagation, unauthorized access, and network scanning, by leaving all network ports open by default.

Auditing and Remediation: The audit script queries the current state of the 'DefaultInboundAction' property for the Private network profile of the Windows Defender Firewall. The remediation script modifies this same property, allowing an administrator to enforce the desired default behavior for inbound connections.

Recommended State Rationale:
- Basic: ['Block'] is the essential baseline for security. It ensures the system is not needlessly exposed to threats on the local network.
- Moderate: ['Block'] remains the recommended state. A default-deny firewall posture is a universal best practice, and there is no moderately secure alternative.
- Strict: ['Block'] is the only acceptable state for a secure system. Security is then managed by creating explicit, granular 'allow' rules for necessary services, rather than weakening the default stance. Any state other than 'Block' is considered insecure.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Block']` |
| **Moderate** | `['Block']` |
| **Strict** | `['Block']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the 'DefaultInboundAction' for the 'Private' firewall profile using the 'Get-NetFirewallProfile' cmdlet. The script must output only the value (e.g., 'Block', 'Allow') and nothing else.

## Remediation Script Working

PowerShell script that sets the 'DefaultInboundAction' for the 'Private' firewall profile using the 'Set-NetFirewallProfile' cmdlet. The script must accept the desired state (e.g., 'Block', 'Allow') as a single, positional command-line argument. It must return '$true' on success and '$false' on failure.

