9.3.5 Ensure 'Windows Firewall: Public: Settings: Apply local firewall rules' is set to 'No'

Information

This setting controls whether local administrators are allowed to create local firewall rules that apply together with firewall rules configured by Group Policy.

The recommended state for this setting is: No

Note: When the Apply local firewall rules setting is configured to No it's recommended to also configure the Display a notification setting to No Otherwise, users will continue to receive messages that ask if they want to unblock a restricted inbound connection, but the user's response will be ignored.

When in the Public profile, there should be no special local firewall exceptions per computer. These settings should be managed by a centralized policy.

Solution

To establish the recommended configuration via GP, set the following UI path to No :

Computer Configuration\Policies\Windows Settings\Security Settings\Windows Firewall with Advanced Security\Windows Firewall with Advanced Security\Windows Firewall Properties\Public Profile\Settings Customize\Apply local firewall rules

Impact:

Administrators can still create firewall rules, but the rules will not be applied.

See Also

https://workbench.cisecurity.org/benchmarks/15301

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7, 800-53|SC-7(5), CSCv7|9.4, CSCv7|11.2

Plugin: Windows

Control ID: eec687c330949fc5f38a7b85c84fd3a6fccaf87a2d3e59fd23dc55b5eaa41b6c