Okay.
Now, what we're going to do is we're going to go ahead and do some Windows firewall policy.
I've got a GPO that I created on the sales clients, O.U.
I'm going to go ahead and edit that GPO and drill into computer configuration policies, windows settings,
security settings.
And you'll see here Windows Firewall with advanced security.
And if I click on this note here, what it's going to do is show me this screen that I can then set
various states of the Windows Firewall Connection Security or IPsec rules and then my inbound and outbound
rules.
The first thing I'm going to do is go into Windows firewall policy and this is where I can turn on or
off firewall based on current state.
So for the domain profile, what I'm going to do is I'm going to say turn it on.
So the Windows firewall will be on when I'm on the corporate network.
Now you'll see here for in-bound connections, the default is to block inbound connections.
The default is to allow outbound connections.
So I'm not going to change any of the defaults.
And I can also do things like customize the firewall notifications, whether or not I allow unicast
response to a multicast or broadcast and allow merging of rules.
So that if I've got rules that have been set across multiple GPOs or within the local firewall, then
I can merge the domain firewall rules with local firewall rules rather than overriding them.
So anyway, let me go ahead and just set my default domain profile to be on and I'm going to set the
public profile to be on as well.
Now that those two are on, I've got Windows Firewall for the public and domain profiles turned on.
I can go ahead and define some inbound rules.
Now remember for the domain in public profiles with the Windows firewall on.
That means no traffic can get inbound.
So what I want to do here is is create a new inbound rule.
And I can either use define a particular program that is allowed to connect inbound a particular port
or I can do predefined services that Microsoft has provided or custom rules.
And I like the predefined services because it's got a lot of things that I would normally want to do
with a system covered here.
So, for example, Windows management, instrumentation, WMI.
I'd like to be able to do remote WMI management against workstations or servers that process this policy.
So I'm going to create an exception for Windows management instrumentation, and you see that it actually
creates three different rules for this particular exception that I've chosen.
And I'm going to allow the connection.
And now I have for all profiles.
I now have these three rules created.
Now, if I wanted to be selective about this, I could say so.
Apply this to only some of the systems that I'm interested in.
I could do advanced, so I could say here on under the advanced tab I can select.
Well, I only want this to apply when I'm on the domain.
I don't want to open up WMI for users that are on public networks, so go ahead and specify it only
for the domain profile.
And I can do that for this one as well.
So all of them are the same.
And now I've created an exception for the default inbound profile.
That allows WMI traffic to get through.
And that's really as simple as it is for creating rules and configuring the firewall.
And you can, you know, set these in multiple GPOs or you can define them all in a single GPO, which
I actually I typically recommend keeping all of your firewall settings together.
Unless you have lots of different kinds of rules that you need to apply.
As an example, you might have a set of firewall rules for workstations that are vastly different than
those for servers, which is completely understandable.
So putting those into separate GPOs makes total sense.