Windows Defender Firewall.
Well, if you've been a Microsoft specialist for a while,
you've seen that the built‑in software firewall in Windows
client and Windows Server has come a long way.
We're talking about a host‑based firewall that is baked into the Windows
OS manageable via Group Policy that allows us to create inbound and
outbound traffic security rules. And the three templates that we have at
our disposal are program‑based rules,
port‑based rules, or custom rules, custom being the
preferred to give you the maximum flexibility.
One principle of Defender Firewall is the location
profile, and this gives the firewall some flexibility in
terms of when you're on a laptop, say a corporate laptop,
when you're connected to the domain,
the domain profile will be active. Then, otherwise, if you connect to say
your home network for the first time, you get that dialog, do you want to
enable sharing on this device? And that decision, you can always change it
later, would be determining whether you'll use private or public for those
new network connections.
So again,
this allows Windows Defender Firewall to maintain separate rule
sets for A, your Active Directory domain,
B, your private networks, for example, your home LAN, and C, public networks.
This would be, for instance, if you go to the coffee shop or you're
in an airport and some untrusted public network. That would, of
course, have very strict rules by default.
As I said,
we can most commonly centrally control Windows Defender
Firewall using Group Policy. No surprises there.
There is a flag that you can flip,
so to speak, in Windows Defender Firewall that Microsoft calls shields up
mode, and this is a way to help mitigate active attacks.
It's a control in the Windows Defender Firewall UI, or user interface,
that will immediately block all new incoming connections.
So it's a way that's analogous to unplugging the system, so to speak.
In other words, by flipping shields up mode,
you're preventing any new incoming network connections.
Here's a screenshot of in the foreground we have the old‑fashioned Defender
Firewall control panel, and then in the background we have the Windows
Defender Firewall with Advanced Security MMC console.
And as you can see on the left side there,
you've got your Inbound,
your Outbound Rules. Then you've got your Connection Security Rules that we'll learn about next.