9.1.3 (L1) Ensure 'Windows Firewall: Domain: Settings: Display a notification' is set to 'No'

Information

Select this option to have Windows Firewall with Advanced Security display notifications to the user when a program is blocked from receiving inbound connections.

The recommended state for this setting is: No

Note: When the Apply local firewall rules setting is configured to No it's recommended to also configure the Display a notification setting to No Otherwise, users will continue to receive messages that ask if they want to unblock a restricted inbound connection, but the user's response will be ignored.

Firewall notifications can be complex and may confuse the end users, who would not be able to address the alert.

Solution

To establish the recommended configuration via GP, set the following UI path to No :

Computer Configuration\Policies\Windows Settings\Security Settings\Windows Defender Firewall with Advanced Security\Windows Defender Firewall with Advanced Security\Windows Firewall Properties\Domain Profile\Settings Customize\Display a notification

Impact:

Windows Firewall will not display a notification when a program is blocked from receiving inbound connections.

See Also

https://workbench.cisecurity.org/benchmarks/16515

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4, CSCv7|11.2

Plugin: Windows

Control ID: 02cf243cb9539fb73abb6eb928baa4acb79f82e281b36ea95017e861abd60827