Hardening Firewall Profiles
🪟PowerShell🪟Windows🍻Script Share
Sharing a script I use to standardize Windows Firewall configuration across client endpoints. Built it for deployment via RMM (I run it through TacticalRMM as a Collector Task) but it runs fine as a standalone script too.
What it does:
Sets default inbound action to Block across Domain, Private, and Public profiles
Enables logging for dropped/blocked packets (configurable log path & size)
Opens only explicitly whitelisted management ports (RDP, WinRM, etc. — fully configurable via a param array)
Idempotent — safe to re-run/redeploy without stacking duplicate rules
Outputs a summary table at the end so you can verify state without opening the GUI
What it deliberately does NOT do:
Doesn't touch outbound by default (there's a -BlockOutboundByDefault switch if you want to go there, but I'd strongly recommend building an outbound allow-list first — this will break Windows Update, agents, etc. if you flip it blind)
Doesn't scope management ports to specific IPs out of the box — that's on you to configure per-environment. Don't leave RDP/WinRM open to Any on anything that ever touches a Public network profile.
What it does:
Sets default inbound action to Block across Domain, Private, and Public profiles
Enables logging for dropped/blocked packets (configurable log path & size)
Opens only explicitly whitelisted management ports (RDP, WinRM, etc. — fully configurable via a param array)
Idempotent — safe to re-run/redeploy without stacking duplicate rules
Outputs a summary table at the end so you can verify state without opening the GUI
What it deliberately does NOT do:
Doesn't touch outbound by default (there's a -BlockOutboundByDefault switch if you want to go there, but I'd strongly recommend building an outbound allow-list first — this will break Windows Update, agents, etc. if you flip it blind)
Doesn't scope management ports to specific IPs out of the box — that's on you to configure per-environment. Don't leave RDP/WinRM open to Any on anything that ever touches a Public network profile.
