Intermediate 5 min read Updated: Sep 10, 2026

Windows Defender Firewall with Advanced Security: Rules & Profiles

Master enterprise host firewall administration: Domain, Private, and Public profiles, rule precedence mechanics, program/port scoping, IPsec connection security rules, and PowerShell management.

Network perimeter firewalls provide vital boundary defense, but they offer zero visibility or control over east-west lateral movement once an attacker compromises an endpoint inside the local subnet. Host-based network defense is the cornerstone of defense-in-depth, and on Windows platforms, this capability is delivered by Windows Defender Firewall with Advanced Security (WFAS).

Operating as a stateful packet inspection firewall integrated deeply with the Windows Filtering Platform (WFP), WFAS evaluates inbound and outbound network traffic based on transport-layer parameters, application executable paths, specific service security identifiers (SIDs), Active Directory user groups, and IPsec cryptographic identities.

Network Location Profiles: Domain, Private, and Public

Windows automatically assigns every network adapter to a specific Network Location Profile based on network detection criteria. WFAS maintains independent configuration policies for each of the three profiles:

Profile Name Automatic Detection Criteria Default Security Posture Typical Enterprise Application
Domain Profile Activated automatically when the network adapter authenticates to an Active Directory Domain Controller for the domain to which the computer is joined. Inbound blocked except rules; Outbound allowed. Permits enterprise management protocols (WinRM, RPC, RDP, WMI). Corporate enterprise LANs, domain-joined branch offices, data center subnets.
Private Profile User- or administrator-designated trusted network (e.g., home office, isolated lab) where the machine is not joined to a corporate domain. Inbound blocked except rules; Outbound allowed. Permits local network discovery (SSDP, LLMNR) and local file/printer sharing. Remote teleworker home LANs, dedicated isolated developer sandbox environments.
Public Profile Assigned by default to all unrecognized networks, direct broadband interfaces, public Wi-Fi hotspots, or untrusted hotel connections. Highest Restrictiveness: Inbound blocked completely except critical core OS services; network discovery, file sharing, and remote management disabled. Traveling laptops, public Wi-Fi access, direct Internet-facing virtual machines.

Multi-Homed Host Behavior: If a server possesses multiple network adapters connected to different networks (e.g., NIC 1 connected to the corporate Domain LAN and NIC 2 connected to a Public DMZ or storage network), Windows Defender Firewall applies the most restrictive profile rules globally while simultaneously applying profile-specific rules to each respective physical interface.

Rule Evaluation Precedence & Processing Logic

When a network packet arrives at or departs from a Windows host, the Windows Filtering Platform evaluates firewall rules in a strictly deterministic sequence:

  1. Windows Service Hardening: Core system rules that restrict system services (e.g., preventing a compromised print spooler service from opening outbound sockets).
  2. Connection Security Rules (IPsec): Determines whether the traffic must be authenticated via Kerberos or certificates, or encrypted via ESP (Encapsulating Security Payload).
  3. Explicit Block Rules: If any matching rule specifies Block, the packet is immediately dropped. Block rules override Allow rules by default.
  4. Allow if Secure Rules: Rules that permit traffic only if it is authenticated or encrypted via IPsec, with optional authorization checks on user or computer accounts.
  5. Standard Allow Rules: Matches explicit permit rules based on program, service, port, protocol, and IP scope.
  6. Default Profile Action: If no rules match the packet, the default profile action is applied (typically Block Inbound and Allow Outbound).

Do Not Disable the Firewall as a Diagnostic Default: Disabling Windows Defender Firewall (Set-NetFirewallProfile -Enabled False) does not simply open ports—it disables the Windows Filtering Platform state machine, terminates active IPsec security associations, dismantles service isolation tokens, and leaves the endpoint completely blind to local subnet scans. Diagnostic troubleshooting should always be performed by creating temporary scoped logging rules or inspecting packet drops via the Security log.

Anatomy of an Enterprise Firewall Rule

Modern host-based rules should be tightly scoped across multiple operational parameters rather than creating open, wildcard port allowances:

  • Program & Service Scoping: Instead of opening port 8080 globally, restrict the rule to the specific binary path: %ProgramFiles%\CustomApp\app.exe. Furthermore, rules can target specific Windows Services via their Service SID, ensuring that even if another process binds to the same port, unauthorized traffic is discarded.
  • Protocol & Ports: Specify Layer 4 protocol (TCP, UDP, ICMPv4, ICMPv6) and exact port ranges.
  • Scope (Local & Remote Addresses): Restrict the rule to authorized administrative subnets (e.g., allowing RDP or WinRM only from 10.10.50.0/24), preventing arbitrary internal workstations from connecting.
  • Interface Types: Limit the rule's application to specific network interface types: Local Area Network (Ethernet), Wireless (802.11), or Remote Access (VPN).

Managing Windows Defender Firewall via PowerShell

Systems administrators manage WFAS policies at scale using the native NetSecurity PowerShell module:

# 1. Inspect the operational state of all three firewall profiles
Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction, LogFileName

# 2. Enable Windows Defender Firewall across all profiles
Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True

# 3. Create a hardened inbound rule for an internal web service
# Scoped strictly to the Domain profile, TCP port 8443, and authorized management subnet
New-NetFirewallRule -Name "App-HTTPS-Internal" `
    -DisplayName "Corporate ERP Web Service (HTTPS 8443)" `
    -Description "Permits internal HTTPS access to ERP application from corporate VLAN" `
    -Profile Domain `
    -Direction Inbound `
    -Action Allow `
    -Protocol TCP `
    -LocalPort 8443 `
    -Program "C:\Program Files\ERPApp\bin\erp_service.exe" `
    -RemoteAddress 10.10.0.0/16

# 4. Create an outbound block rule to prevent PowerShell from making outbound Internet connections
New-NetFirewallRule -Name "Block-PowerShell-Outbound-Internet" `
    -DisplayName "Block Outbound Internet Access for PowerShell" `
    -Direction Outbound `
    -Action Block `
    -Program "%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" `
    -RemoteAddress "10.0.0.0/8","172.16.0.0/12","192.168.0.0/16" -PolicyStore ActiveStore

Enabling Packet Drop Logging for Diagnostics

When troubleshooting network connectivity issues without disabling protection, enable drop logging to record discarded connections in real-time:

# Enable dropped packet logging on the Domain profile
Set-NetFirewallProfile -Profile Domain -LogDroppedPackets True -LogFileName "%SystemRoot%\system32\LogFiles\Firewall\pfirewall.log" -LogMaxSizeKilobytes 16384

# Monitor the firewall log file in real-time using PowerShell
Get-Content -Path "C:\Windows\system32\LogFiles\Firewall\pfirewall.log" -Tail 20 -Wait

Analyze log entries with the action code DROP to identify blocked IP addresses, port numbers, and matching transport protocols without lowering host defenses.

Code copied to clipboard!