Mastering Windows Firewall Checks with PowerShell

Key takeaways

• Efficient firewall status checks: The PowerShell script allows quick verification of Windows Firewall profiles, significantly enhancing network security management.
• Customizable and flexible: Adaptable to specific needs, the script can check individual or multiple firewall profiles and supports environmental variables.
• Enhanced security posture: Regular use helps maintain consistent security standards and identifies potential vulnerabilities in firewall configurations.
• Time-saving automation: Automates a routine task, reducing manual effort and minimizing the risk of human error.
• Scalability for larger networks: Ideal for use across multiple systems, making it a valuable tool for IT professionals managing extensive networks.
• Compatibility and requirements: Designed for Windows 10 and Windows Server 2012 R2, making it suitable for modern IT environments.
• Integration with IT management tools: Can be combined with comprehensive IT management solutions like NinjaOne for a more robust security and management strategy.

Introduction

Understanding and managing network security is a critical task in today’s IT environment. Firewalls serve as a first line of defense against various cyber threats, making it crucial for IT professionals to regularly check and monitor their status. In this context, PowerShell scripts become invaluable tools, offering efficient ways to manage and report on firewall configurations across Windows systems.

Background

The script in focus is designed for IT professionals, Managed Service Providers (MSPs), and network administrators who require a quick and efficient method to check the status of Windows Firewall profiles. This PowerShell script is especially relevant given the increasing need for robust security measures in the face of escalating cyber threats. The script’s ability to provide detailed insights into firewall status is an asset in maintaining network security and compliance.

The script:

<#
.SYNOPSIS
    Get the current status of the specified windows firewall profile. If none is specified it will check all of them.
.DESCRIPTION
    Get the current status of the specified windows firewall profile. If none is specified it will check all of them. 
    An exit code of 1 indicates that one or more profiles are currently disabled and 2 indicates some sort of error. 
    It will also output a status message.
.EXAMPLE
    (No Parameters)
    WARNING: The Private Firewall Profile is disabled!
    The Domain Firewall Profile is enabled!
    The Public Firewall Profile is enabled!

PARAMETER: -Name "Domain,Private"
    This will accept a string or array of strings representing the firewall profile names you want to check.
.EXAMPLE
    -Name "Domain,Private"
    WARNING: The Private Firewall Profile is disabled!
    The Domain Firewall Profile is enabled!
.EXAMPLE
    -Name "Domain"
    The Domain Firewall Profile is enabled!

.OUTPUTS
    None
.NOTES
    General Notes
    Minimum OS Architecture Supported: Windows 10, Windows Server 2012 R2
    Release Notes: Initial Release
By using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https://www.ninjaone.com/terms-of-use.
    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. 
    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. 
    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. 
    Warranty Disclaimer: The script is provided “as is” and “as available”, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. 
    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. 
    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. 
    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).
#>

[CmdletBinding()]
param (
    [Parameter()]
    [String]$Name = "All"
)
begin {
    function Get-FirewallStatus () {
        [CmdletBinding()]
        param(
            [Parameter(ValueFromPipeline)]
            [ValidateSet("All", "Domain", "Public", "Private")]
            [String]$Name
        )
        process {
            if ($Name -contains "All") {
                $Result = Get-NetFirewallProfile -All | Select-Object "Name", "Enabled", "DefaultInboundAction"
                
            }
            else {
                $Result = Get-NetFirewallProfile -Name $Name | Select-Object "Name", "Enabled", "DefaultInboundAction"
            }

            $Result | ForEach-Object {
                if (($_.Enabled -like $False) -or ($_.DefaultInboundAction -like "Allow")) {
                    Write-Warning "The $($_ | Select-Object Name -ExpandProperty Name) Firewall Profile is disabled or not set to block inbound connections!"
                }
                else {
                    Write-Host "The $($_ | Select-Object Name -ExpandProperty Name) Firewall Profile is enabled and blocking inbound connections!"
                }
            }
            
            $Result
        }
    }

    $Names = New-Object -TypeName "System.Collections.ArrayList"
    if ($env:publicProfile -or $env:privateProfile -or $env:domainProfile -or $env:allProfiles) {
        if ($env:publicProfile -and $env:publicProfile -notlike "false") { $Names.add("Public") | Out-Null }
        if ($env:privateProfile -and $env:privateProfile -notlike "false") { $Names.Add("Private") | Out-Null }
        if ($env:domainProfile -and $env:DomainProfile -notlike "false") { $Names.Add("Domain") | Out-Null }
        if ($env:allProfiles -and $env:allProfiles -notlike "false") { $Names.Add("All") | Out-Null }
    }
    else {
        $Name -split "," | ForEach-Object { $Names.add($_.trim()) | Out-Null }
    }
    
    if ($Names -contains "All") {
        $Names = "All"
    }

    $ExitCode = 0
}
process {
    try {
        $Result = $Names | Get-FirewallStatus -ErrorAction Stop 
    }
    catch {
        Write-Error "[Error] Invalid Input! The only valid profile names are Domain, Private, Public and All."
        exit 2
    }

    $Result | ForEach-Object {
        if($_.Enabled -like $False -or $_.DefaultInboundAction -like "Allow"){
            $ExitCode = 1
        }
    }

    exit $ExitCode
}
end {
    
    
    
}

 

Detailed breakdown

The script begins with a CmdletBinding attribute, indicating advanced functions of a cmdlet. Parameters are defined for selecting specific firewall profiles.

The core function, Get-FirewallStatus, uses the Get-NetFirewallProfile cmdlet to fetch firewall profile details. The script processes each firewall profile, checking if it’s enabled and if it blocks inbound connections.

A warning message is displayed if a profile is disabled or not set to block inbound connections, enhancing the script’s utility in quickly identifying potential security lapses.

The script supports environment variables and allows for checking multiple profiles simultaneously, enhancing its flexibility and usability in diverse IT environments.

Potential use cases

Imagine an IT administrator responsible for ensuring the security of a company’s network. By running this script, they can quickly ascertain the status of the firewall profiles across different systems, ensuring compliance with the company’s security policies.

Comparisons

Compared to manual checks or using the Windows Firewall GUI, this script provides a more efficient and scalable solution. It can be integrated into larger automation workflows, saving time and reducing human error.

FAQs

Q: Can the script check firewall status on remote computers?
A: The script is designed for local execution, but it can be adapted for remote execution using PowerShell remoting features.

Q: Is the script compatible with older versions of Windows?
A: The script requires a minimum of Windows 10 or Windows Server 2012 R2.

Implications

Inadequately configured firewalls can lead to vulnerabilities in the network. By regularly using this script, IT professionals can proactively identify and rectify such weaknesses, significantly enhancing network security.

Recommendations

It’s recommended to schedule this script to run at regular intervals. Additionally, integrating the script output into a monitoring system can help in maintaining continuous oversight of firewall status.

Final thoughts

Incorporating this script into the broader network management strategy, including tools like NinjaOne, can significantly enhance an organization’s capacity to manage its IT infrastructure. NinjaOne offers comprehensive IT management solutions that can work in tandem with custom scripts like this, providing a more cohesive and robust IT management ecosystem.