In this demonstration,
we're going to ensure your familiarity with Defender Firewall,
both configuring it on a server‑by‑server basis, as
well as centrally in Group Policy.
So here we are on a Windows Server 2022 box, and I want to start
by opening up Start and looking for firewall.
Let's review the different ways we can manage this application.
We can go to Windows Defender Firewall specifically. That
brings up the old‑fashioned Control Panel.
Let me go back to Start and type firewall again. There's also Firewall &
network protection that's part of the Settings pane. Personally,
I'm not a really big fan of the Settings application
across the board, so I'm just going to dismiss that
window and pretend it doesn't exist.
So the UI here looks virtually identical between Windows Server
and Windows Client. Number one, we've got our controls, which are
all governed by User Access Controls.
So by definition, a standard non‑administrative user on a
workstation would not be able to adjust these.
You'll note that for all three location profiles,
I've got Defender turned off. Well, that's not good.
So we can easily remediate that just by flipping these switches,
turning it to On. And as we can see on the home page in the Defender
Firewall Control Panel because I'm on a domain‑joined machine, the domain
profile is the active one at this point in time.
Okay, now you might have noticed that when I opened Start and looked
for firewall, we also have the Windows Defender Firewall with Advanced
Security Microsoft Management Console.
And this kind of leads us over into centralized management of Defender
Firewall for your Windows Server and Windows Client machines. We've got on
the main node here this overview where we can click to get into a modified
version of the Firewall control panel.
It's kind of inscrutable to me, honestly,
why there are so many UIs for Windows Defender Firewall.
You ever notice that? And as a matter of fact,
if I bring up the service control manager here,
I want you to understand that Windows Defender Firewall does run as a Windows
service, and it runs under Local Service security context.
When you've onboarded your server into other of the
Microsoft Defender Cloud services,
there may be additional services that come online here.
I've got this machine enrolled with Microsoft Defender Endpoint protection.
So there's an Advanced Threat Protection service here running as well.
But the main one I want to draw your attention to is the
Windows Defender Firewall service.
So what else do we need to know about this for the AZ‑801 exam?
Well, we need to understand the basics of creating rules.
So first of all, I want you to see we've got Inbound and Outbound Rules
specifically, and there's a huge library of pre‑built rules that come out
of the box in Windows, others that get brought in here as you load server
roles and features onto a machine.
As you can see here, there's a number of Active Directory Domain Services.
Why do we care about all these built‑in rules? Well, we want to make sure
that as we're configuring our Windows Server boxes,
we're not creating a denial of service.
We want to keep the firewall on in order to protect the machine at the
network layer, but we need to create these exceptions, these allow rules to
allow our line of business traffic to actually work.
So let's right‑click on Inbound Rules, and let's go to New Rule, and
let me familiarize you with the Inbound Rule Wizard.
Hopefully, you already are familiar,
but if not here we go. Notice that we've got Program, Port,
Predefined, and Custom. First, I want to show Predefined, and these
are almost all in Windows Server aligned to different server roles,
like DFS and file services, BranchCache,
DNS, Remote Desktop, Remote Management, firewall,
that kind of stuff.
And those entries allow you to easily create exceptions for services if those
rules aren't auto created by the service. If we go to Port,
this would be a common one that I have seen. When you have
specific TCP or UDP exceptions that you want to make, as you can
see here, so I could say this is TCP and is this going to apply
to local ports or all ports?
I'm going to say All local ports. And then we can decide are we going to
allow, are we going to block, or notice this third option, allow the
connection if it's secure? So this is an example of connection security
rules where we're bringing in IPsec to add authentication and possibly
encryption to that communication.
All right, let me right‑click, go to New Rule again.
Lastly, let me come down to Custom. And this one is where I
normally go because the Custom path gives you control over
all of the preceding templates.
In other words,
we can apply the rule only to specific executables, as you can see, specific
services, and then we can choose right down to not just the port and the
number, but we can choose protocols and message types.
Here's a common one that I use in industry and that would be ICMP,
the Internet Control Message Protocol, v4. And then we could
even go further and say we want to create an allowance for
specific ICMP types like Echo Request.
This is what you would want to do to allow ping into the server.
Now there's probably a predefined rule that makes it easier.
This is kind of the long way around, but you see where I'm going here.
I just want to outline the UI and some of the possibilities. The
Defenders Firewall is pretty useful in that regard of you being able
to quite granularly define these rules. In this case, in the Custom
path for creating an inbound rule, we can specify what addresses does
this rule apply to.
So we've got Any IP address on this machine, let's say, or we could go
to the interface level and maybe only wireless, maybe only wired. Which
remote IP addresses does this apply to?
Once again, we come down to our rule. Is this going to be an Allow, a Block,
or are we going to do an IPsec policy? In which case, as I already mentioned
earlier in the theory part of this lesson,
you can do authentication, you can do integrity, and you also can do encryption.
This would be the authentication header and encapsulating security
payload IPsec protocol, specifically. All right,
so those are some of the basic mechanics of working with rule
definitions. And then as you can see here,
let's just pick on a particular rule here.
It looks like this predefined rule covers the Echo
Request ICMPv4‑in scenario pretty well.
One complaint I have about this interface,
I wish it were more searchable and filterable. Of course,
you always could use PowerShell to write search queries, but
it can be a little cumbersome, especially when you're on a production server,
like a domain controller here. And you'll notice here that because
this one I double‑clicked on is not an administrator‑created rule,
but one that comes out of the box,
some of the properties will be read only. You won't be able to adjust
everything. But what I want to show you here is that you can go into a rule
that's already been created, and you can override or make choices different
from how it was set up when you created the rules.
Something else I almost forgot to mention is that you attach
your rules to those location profiles.
So this particular allow ping, you may only want to come into play
when the machine is connected to an Active Directory domain and
not when you're in a private or public. Specifically, I wouldn't
want a public link there, so I'll just choose Domain or Private and click OK to update that change.