ADGPO-019: Windows Firewall Configuration via GPO
- Platform
- Active Directory
- Category
- AD Group Policy
- Severity
- Medium
- Zero Trust pillar
- Governance (weight 1)
- Golden fixtures
- 2
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
For every GPO returned by Get-GPO -All, the check parses both the registry-based firewall settings (HKLM\Software\Policies\Microsoft\WindowsFirewall\*) and the WFAS rule collection stored in the GPO under Machine\Microsoft\Windows NT\SecEdit and \Machine\Microsoft\Windows Firewall With Advanced Security. The audit logic evaluates: - EnableFirewall (DWORD) per profile (DomainProfile, PrivateProfile, PublicProfile). Any profile set to 0 is a finding. - DefaultInboundAction per profile. Anything other than 1 (Block) is a finding. - DefaultOutboundAction per profile. Allow is the documented default; the check flags only obvious anomalies (such as DefaultOutboundAction = 1 combined with no allow rules, which silently blocks all egress). - DisableNotifications and DisableUnicastResponsesToMulticastBroadcast, which alter analyst visibility. - LogDroppedPackets and LogSuccessfulConnections per profile. Both off on a server-class host is a finding. - AllowLocalPolicyMerge and AllowLocalIPsecPolicyMerge. When set to 1, local administrators (or attackers with local SYSTEM) can add inbound rules that override the GPO; the check flags this for Tier-0 OUs. - The full inbound rule set, parsed from the GPO. Any rule with Action=Allow, Direction=In, RemoteAddress=Any, and Profile covering Public or Domain is flagged. Special weight is given to rules that allow TCP 135/139/445/3389/5985/5986 or ICMP from RemoteAddress=Any. - Service-restricted rules: an Allow rule scoped to a Windows service SID (RestrictedServiceName) is treated differently than a rule with no service restriction. For each finding the check captures the GPO display name, GUID, GpoStatus, the linked SOMs, the profile, the offending setting or rule name, and whether the GPO is currently applying (cross-referenced with ADGPO-009).
Why it matters
The Windows Defender Firewall is the only host-resident control that consistently blocks the network primitives used by every post-exploitation framework: SMB (445) for PsExec, RemoteExec, and SMBexec; RPC (135 plus dynamic high ports) for WMI, DCOM, and the Service Control Manager; WinRM (5985/5986) for PowerShell Remoting and Evil-WinRM; and RDP (3389) for interactive lateral movement. When a GPO sets EnableFirewall = 0 on the Domain profile, every host in the linked OU accepts inbound connections to any listening service from any source on the corporate network, which is the canonical precondition for SMB lateral movement, NTLM relay against SMB and HTTP, PrintNightmare (MS-RPRN) reachability, PetitPotam (MS-EFSRPC) reachability, and RPC-based credential dumping (DRSUAPI for DCSync, comsvcs.dll for LSASS dump over admin shares). A GPO that leaves the firewall enabled but inserts an Allow inbound rule for "File and Printer Sharing (SMB-In)" with RemoteAddress=Any has the same operational effect as disabling the firewall for ransomware crews who already have one foothold. The MITRE Impair Defenses technique (T1562.004) explicitly enumerates firewall modification as a high-value preparatory step for adversaries with administrative rights, and the Group Policy Modification technique (T1484.001) is the persistent variant that survives GPP refresh and password rotations because the change lives in SYSVOL rather than on the endpoint. For domain controllers and Tier-0 servers, the blast radius is forest-wide: a DC with an open firewall is the canonical lateral-movement pivot for Golden Ticket use, DCSync, and DNSAdmin abuse.
Attack path
1. Reconnaissance: with any authenticated domain user, the attacker pulls every GPO and parses the firewall section of each. PowerView Get-DomainGPO returns the GPO list, Get-DomainGPOLocalGroup correlates GPOs to OUs, and a direct read of \\domain\SYSVOL\domain\Policies\{GUID}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf plus the registry.pol files returns the EnableFirewall and DefaultInboundAction values without privileged rights. 2. Identification of soft scopes: the attacker maps OUs where EnableFirewall = 0 or DefaultInboundAction = Allow. Workstation OUs with open firewalls are flagged as lateral-movement playgrounds; server OUs are flagged as service-abuse targets; the Domain Controllers OU with an open firewall is flagged as a Tier-0 pivot. 3. Foothold: from a single compromised endpoint, the attacker scans the OU for listening services. With SMB open, they enumerate shares with smbclient or crackmapexec smb. With RPC open, they enumerate via impacket rpcdump and rpcclient. With WinRM open, they spray credentials with crackmapexec winrm or Evil-WinRM. 4. Lateral movement: open SMB enables PsExec, Impacket smbexec, and pass-the-hash with crackmapexec. Open RPC enables wmiexec, dcomexec, and atexec. Open WinRM enables Invoke-Command and Evil-WinRM. None of these require touching the endpoint firewall because the GPO already left it open. 5. Coercion and relay: with SMB and RPC open on workstations and servers, the attacker triggers PetitPotam (MS-EFSRPC EfsRpcOpenFileRaw) or PrinterBug (MS-RPRN RpcRemoteFindFirstPrinterChangeNotificationEx) against any reachable host to coerce machine-account NTLM authentication, then relays the authentication to ADCS HTTP enrollment (ESC8) or to LDAP for Resource-Based Constrained Delegation. 6. Persistence via the same GPO: if the attacker also has GPO edit rights (delegated permission, Group Policy Creator Owners membership, or a writeable ACE on the GPO container), they tighten the rule to reference their own implant ports and call the change "hardening" so a defender reviewing the GPO history sees benign churn. 7. Evasion: when LogDroppedPackets is off (the default), there is no on-host evidence of the connection attempts that the firewall would otherwise have blocked. When AllowLocalPolicyMerge is on, the attacker with SYSTEM can add a local rule that survives across gpupdate cycles because the merge happens after policy refresh.
How Guerrilla assesses it
Guerrilla loads the GroupPolicy module and enumerates every GPO with Get-GPO -All. For each GPO it parses two surfaces. First, it reads the registry-based firewall settings by mounting the GPO registry.pol files (\\$domain\SYSVOL\$domain\Policies\{$id}\Machine\registry.pol) and walking the keys under Software\Policies\Microsoft\WindowsFirewall\DomainProfile, \PrivateProfile, and \PublicProfile, recording EnableFirewall, DefaultInboundAction, DefaultOutboundAction, DisableNotifications, LogDroppedPackets, LogSuccessfulConnections, AllowLocalPolicyMerge, and AllowLocalIPsecPolicyMerge. Second, it parses the WFAS rule collection stored in the GPO under \Machine\Microsoft\Windows Firewall With Advanced Security and reads the FirewallRules and ConSecRules entries, then translates each rule string (Action, Direction, Protocol, LocalPort, RemoteAddress, RemoteUserAuthorizedList, Service, Profile, Enabled) into a structured object. Each rule is scored against an allowlist: Allow + Inbound + RemoteAddress=Any + a sensitive port set (135, 137-139, 445, 3389, 5985, 5986, 47001, 49152-65535) on the Domain or Public profile is the high-severity bucket. The check also enumerates linked SOMs via Get-ADOrganizationalUnit -LDAPFilter "(gPLink=*$id*)" plus the domain root and the Sites container, and cross-references the apply trustees so an inert GPO (no valid Apply principal per ADGPO-009) is downgraded to informational. Output rows include GpoName, GpoId, Profile, Setting (or RuleName), CurrentValue, RecommendedValue, LinkedScopes, AppliesToTier0 (bool), and Severity.
Recommended value
Windows Firewall enabled for all profiles (Domain, Private, Public) with deny-by-default inbound rules configured via GPO
Remediation
Review Windows Firewall GPO settings across all applicable GPOs. Ensure the firewall is enabled for Domain, Private, and Public profiles. Verify that inbound rules follow a deny-by-default approach with specific allow rules for required services only. Remove any GPO settings that disable the Windows Firewall. Test firewall rules in a staging OU before domain-wide deployment.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| informational | WARN |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- SC-7, SC-7(5), CM-6
- MITRE ATT&CK
- T1484.001, T1562.004