Windows Defender Firewall

1.6 Given a scenario, configure Microsoft Windows settings

📘CompTIA A+ Core 2 (220-1202)

---

Windows Defender Firewall is a built-in security feature in Windows that helps protect a computer from unwanted access from the internet or network. It acts like a filter, controlling what data comes in and goes out of your computer.

---

1. Purpose of Windows Defender Firewall

The firewall has two main purposes:

1. Block unauthorized access – Prevent hackers or malware from accessing your computer over a network.
2. Control outbound traffic – Restrict which apps can connect to the internet, helping prevent malware or unsafe apps from sending data out.

IT Example:

• An IT admin may block a specific application from accessing the internet in a corporate network using Windows Defender Firewall.

---

2. How to Access Windows Defender Firewall

You can open it in multiple ways:

• Through Control Panel:
  1. Open Control Panel → System and Security → Windows Defender Firewall
• Through Settings (Windows 10/11):
  1. Go to Settings → Privacy & Security → Windows Security → Firewall & network protection
• Through Command Line (for advanced users):
  • Using wf.msc to open the Windows Defender Firewall with Advanced Security console.

---

3. Firewall Profiles

Windows Defender Firewall uses profiles to apply different rules depending on the type of network:

1. Domain profile:
   • Used when connected to a company network that uses Active Directory.
   • IT admins can enforce strict rules here.
2. Private profile:
   • Used for trusted networks, like your office LAN.
   • Allows more flexibility but still protects your PC.
3. Public profile:
   • Used for untrusted networks, like public Wi-Fi.
   • Most restrictive profile to prevent attacks.

Exam Tip: Know these three profiles and their purpose.

---

4. Key Features and Settings

A. Turn Firewall On/Off

• Turn On: Recommended to keep your PC protected.
• Turn Off: Only temporarily, e.g., troubleshooting connectivity issues.

B. Allow an App Through Firewall

• Lets certain programs bypass the firewall.
• Steps:
  1. Open Firewall settings → Allow an app or feature through firewall
  2. Check the program you want to allow.
  3. Choose Private, Public, or both.

IT Example: Allowing Remote Desktop (RDP) on a corporate laptop for IT support.

C. Advanced Settings

• Open Windows Defender Firewall with Advanced Security (wf.msc)
• Here, you can:
  • Create Inbound Rules → Controls incoming traffic.
  • Create Outbound Rules → Controls outgoing traffic.
  • Monitor active connections.

IT Example: Blocking a suspicious app from sending data to the internet using an Outbound Rule.

D. Notifications

• Firewall can alert users when a program is blocked.
• Helps in troubleshooting app connectivity issues safely.

E. Logging

• Windows Defender Firewall can log blocked connections.
• Logs are useful for IT admins to detect attacks or misbehaving software.
• Default log location:
  C:\Windows\System32\LogFiles\Firewall\pfirewall.log

---

5. Common Tasks for Exam

1. Allow/block programs or ports
   • Example: Allow port 80 for web servers, block port 23 for Telnet (insecure).
2. Enable/disable firewall for specific networks
   • Example: Disable firewall temporarily for a trusted Private network to troubleshoot file sharing.
3. Use advanced rules
   • Example: Block a specific IP or subnet from accessing the system.
4. Monitor firewall activity
   • Example: Check logs if an application cannot connect to the internet.

---

6. Exam Tips

• Know the difference between Inbound vs Outbound rules.
• Remember the three network profiles: Domain, Private, Public.
• Understand how to allow/block apps and ports.
• Remember how Windows Defender Firewall protects both local and internet traffic.
• Be able to access the firewall via Control Panel, Settings, or wf.msc.

---

7. Summary

Concept	What It Does	Example in IT Environment
Inbound Rule	Controls incoming traffic	Block unauthorized SSH attempts
Outbound Rule	Controls outgoing traffic	Block malware from sending data
Profiles	Domain / Private / Public	Public = Coffee shop Wi-Fi
Allow an App	Lets an app bypass firewall	Allow RDP for IT support
Logs	Track blocked connections	Check if software was blocked

Bottom line: Windows Defender Firewall is essential for protecting Windows PCs and controlling network traffic. For the exam, focus on rules, profiles, allowing/blocking apps, and accessing advanced settings.