Information
This setting determines the behavior for inbound connections that do not match an inbound firewall rule.
The recommended state for this setting is: Block (default).
Rationale:
If the firewall allows all traffic to access the system then an attacker may be more easily able to remotely exploit a weakness in a network service.
Impact:
None - this is the default behavior.
Solution
To establish the recommended configuration via GP, set the following UI path to Block (default):
Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Domain Profile\Inbound connections
Default Value:
Block (default). (The Windows Firewall with Advanced Security will block all inbound connections that do not match an inbound firewall rule in this profile.)
Additional Information:
Windows Firewall with Advanced Security Technical Implementation Guide:
Version 1, Release 7, Benchmark Date: April 27, 2018
Vul ID: V-17418
Rule ID: SV-54859r3_rule
STIG ID: WNFWA-000004
Severity: CAT I