Skip to content
WindowsHardening

Area 07 / 12

Windows Firewall

The host firewall is the cheapest lateral-movement control you already own. This area enforces all three profiles through policy, ignores locally added rules, restricts RDP, WinRM and SMB to management subnets, blocks peer-to-peer traffic between workstations and enables logging you can actually use during an investigation.

Start the path

Learning path

0/4 done
  1. 01Windows Firewall hardening against lateral movementUse Windows Defender Firewall as a lateral-movement control: enforce all profiles by GPO, ignore local rules, scope RDP/WinRM/SMB to management subnets and log what matters.
  2. 02Windows Firewall logging and monitoring that worksTurn Windows Firewall into a detection source: configure pfirewall.log, WFP audit events 5156/5157, rule-change events 4946-4950 and forward them centrally.
  3. 03Managing Windows Firewall at scale with GPO and IntuneRun Windows Firewall policy across a fleet: how GPO and Intune rules merge, why block beats allow, disabling local merge and checking the active store.
  4. 04Domain and server isolation with IPsecUse IPsec connection security rules so only authenticated domain computers reach your servers: domain and server isolation, crypto choices, safe rollout.