9.2.4 Ensure 'Windows Firewall: Private: Settings: Display a notification' is set to 'No'

Information

Select this option to have Windows Firewall with Advanced Security display notifications to the user when a program is blocked from receiving inbound connections.

The recommended state for this setting is: No.

Note: When the Apply local firewall rules setting is configured to No, it's recommended to also configure the Display a notification setting to No. Otherwise, users will continue to receive messages that ask if they want to unblock a restricted inbound connection, but the user's response will be ignored.

Rationale:

Firewall notifications can be complex and may confuse the end users, who would not be able to address the alert.

Impact:

Windows Firewall will not display a notification when a program is blocked from receiving inbound connections.

Solution

To establish the recommended configuration via GP, set the following UI path to No:

Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Private Profile\Settings Customize\Display a notification

Default Value:

Yes. (Windows Firewall with Advanced Security will display a notification when a program is blocked from receiving inbound connections.)

See Also

https://workbench.cisecurity.org/benchmarks/14249

Item Details

Category: SECURITY ASSESSMENT AND AUTHORIZATION, CONFIGURATION MANAGEMENT

References: 800-53|CA-3, 800-53|CA-9, 800-53|CM-3, CCE|CCE-33065-4, CSCv7|11.2, CSCv7|11.3

Plugin: Windows

Control ID: 4c00e24fc876d8ec7436d8cd650303bdc5211f413836b9f581849872b1e1bce5