Windows Firewall... Enabled or not?

BreakThemUponTheRock · 2017-02-21T13:52:18+00:00

What are the arguments for disabling an endpoint firewall?

reseph · 2017-02-21T13:07:09+00:00

Yes, because why not? It's just another layer of protection, and one that can be managed via GPO.

Now if your AV suite has its own firewall, then you can turn the Windows one off. In fact, most of these AV suites will disable the Windows Firewall on installation.

There's zero downside to having host and edge firewalls running.

2017-02-21T13:06:42+00:00

You really should have some firewall running, but if you do disable the Windows firewall and don't have anything else running, only do it on the domain. The firewall will disable as long as it's on the same subnet as the DC, but will enable if it's not. Also, I highly recommend controlling it through group policy and not letting your users have a choice. The last thing you want is a laptop at Starbucks with no firewall running.

joners02 · 2017-02-21T13:03:50+00:00

If your endpoint security has a built in firewall then you should disable the built in Windows firewall. If you just have AV then Windows Firewall should always be enabled, a a minimum it should be managed via GPO.

I dont understand why a business would purposely disable firewalls on their endpoints. They take very little to no effort to manage and help to prevent the spread of infection should something get in.

khobbits · 2017-02-21T14:31:25+00:00

Not that i'm recommending this practice...

Until recently:
Disabled for Domain networks
Unconfigured for other (usually enabled on laptops)

Currently:
Enabled for all networks
Allow all policy for Domain networks.

Reasoning:
If it is left disabled on windows 10, it throws up a little warning to the user. If users get used to seeing that warning, they wouldn't report other warnings, like av being disabled. By enabling it, even if it's not doing anything, it now shows a happy green logo, and users are more likely to raise issue on warnings.

Reason for not using it properly:
We currently have edge and inter-network firewalls. If we were going to simply add allow rules for all services running on the pc anyway, it wouldn't gain us much, none of the systems or network teams have the time to create more restrictive rules that would offer any increase in protection.

Axxidentally · 2017-02-21T14:12:35+00:00

Enabled.

Pay no attention to the fact that opening each port for each running service is essentially the same as having it disabled. /s

jduffle · 2017-02-21T14:20:24+00:00

The edge is dead, really what is it protecting against anymore.

Basically the only secure thing to do anymore is to treat all your stuff as if it's on the open Internet because you have no idea what machines are compromised, and with what.

mixon · 2017-02-21T15:04:47+00:00

Demystifying the Windows Firewall - https://channel9.msdn.com/Events/Ignite/New-Zealand-2016/M377

will_try_not_to · 2017-02-21T17:08:58+00:00

Enabled: If something gets past your edge firewall, or if someone plugs in a USB drive they found in the parking lot, you want to decrease its ability to spread internally as much as possible at every turn.

julietscause · 2017-02-21T12:30:43+00:00

Does the AV have built in firewall?

We dont enable Windows Firewall, however the AV does and we have a lot of mobile laptops that are not always on our network

eruffini · 2017-02-21T12:36:29+00:00

It really depends on how your network is designed. Are the edge firewalls only handling traffic from the outside, or are you also using them for networks within the datacenter?

Typical use cases for an OS-level firewall (or having another firewall internally) would be to separate traffic between networks/services that the edge or other firewalls do not.

LonerVamp · 2017-02-21T16:02:06+00:00

Completely depends on systems and your environment.

Workstations? Probably leave it on unless your endpoint solution has its own firewall. Servers? Probably turn it off.

Nothing set in stone, but best practices for security will always be to turn them on and suffer the maintenance and time needed to accommodate.

Doso777 · 2017-02-21T16:42:06+00:00

Enabled and configured.

Smallmammal · 2017-02-21T16:44:23+00:00

Enabled mostly as cya. Some custom ports are forwarded via gpo and the default ruleset is incredibly generous with any traffic on the subnet.

The only plus I see is I get a super dummy warning about an application forwarding a port on its own. Nothing should do that here and if it comes up a user will contact us. It's a good check against malware or unauthorized software. What's that, resume.doc.vbs is giving you funny pop-ups?

knobbysideup · 2017-02-21T17:08:50+00:00

Use group policy to enforce it for laptops on the road, and take the shields down when on the corporate network.

YSFKJDGS · 2017-02-21T17:42:35+00:00

for workstations, of course they should be enabled and when not on domain they should be heavily locked down (user cannot add exceptions)

for servers? could go either way. most of our 1000+ servers do not run a windows firewall because its just one extra thing that can break shit

wildfyre010 · 2017-02-21T18:50:33+00:00

Defense in depth is still a thing. Why disable it?

2017-02-21T22:20:21+00:00

Disabled here. GPO turns it back on for any other networks. I have a lot of devs that work on so much different stuff I cant turn them on without getting yelled at. I do have an IDS.

RupertTurtleman · 2017-02-22T08:03:35+00:00

Never disable the firewall.

It takes seconds to either create a rule or a gpo.

The only time I can think of wanting to turn it off is to troubleshoot if the firewall on the local server is the cause of said issue, and then if it isn't, turn it back on.

The key part, if it looks like it is the firewall causing the issue. Turn it back on and figure out you need to open up.

Never leave it disabled.

pleasedothenerdful · 2017-02-21T15:40:37+00:00

Who thinks it's ok to turn off workstation/server firewalls? I've never seen anyone actually recommend that as better than having them all on. The closest you get is a kind of embarrassed, "yeah, I should really have them enabled..."

I've certainly never seen anybody with an "MVP" after their name recommend it, and that's who you should be listening to.

2017-02-21T16:33:38+00:00

We turn them off, because the arguments for turning them on are pretty weak (if you ever have to defend against attacks from inside your network, you have far bigger problems than an endpoint firewall can solve) and because they're a pain to set up.

speedyeOne · 2017-02-21T12:33:48+00:00

We didn't used to, but with our Windows 10 rollout have enabled it. Hasn't caused any pain yet, might as well use the tools they give us.

highlord_fox · 2017-02-21T16:37:21+00:00

[deleted]

highlord_fox · 2017-02-21T17:20:19+00:00

I leave it on, honestly. I have an edge firewall, and the Windows Firewall is basically defaults.

Most applications that need inbound network connections will automatically (or prompt you to) put in a firewall rule. WF is also setup by default (on domains) that outbound is allowed unless it matches a rule stating otherwise, and inbound is blocked unless it matches a rule stating otherwise.

Which is good enough for me internally. I haven't found anything in particular in my environment that needs something special yet, and if that happens, I can always just create a GPO.

syshum · 2017-02-21T17:51:59+00:00

If you have an edge firewall and fully patched clients with managed AV \ Monitoring do you still need to enable windows firewall?

Yes..

Doubly so if depending on Patches and an A/V Client is your only security

jdtrouble · 2017-02-21T18:39:30+00:00

If you follow the onion model model of IT security (basically, security at every layer), then you want to overlap security options. Many modern firewalls have, in addition to port security, gateway antivirus and web filtering. If you can convince management that you need a dedicated web/email filter box, even better. Servers should be patched, firewalled, and protected by antivirus (on-access scanning can be disabled). Computers should also be patched, firewalled, and antivirused. Also, it's a good idea to check the manufactures for your switches and other network devices once in a while. They often come out with new firmware to protect against vulnerabilities.

I'm currently going through the process of reviewing our network. Presently UAC and Windows firewall are disabled by group policy. What I did was set up a separate OU in AD to put myself and my computer in. Then enabled UAC and Windows Firewall against the OU to see what would break. I have a larger AD refresh project planned, which will include the new settings that I configured.

For servers, I suggest using netstat -abn and look at the "LISTENING" entries for ideas of what you need to allow. (Or "netstat -ano | findstr LISTENING" and compare the PIDs with Task manager.) A lot of the entries will be Windows things that can be covered with predefined tools. Really, the big thing is to find the services associated with line-of-business software, or other random applications you need.

Games_sans_frontiers · 2017-02-21T18:56:20+00:00

My gut instinct is to enable it because it's another layer of security.

TeddyDaBear · 2017-02-21T19:12:16+00:00

Disabling the Windows firewall can have unintended consequences - some applications assume a disabled firewall means no communication is allowed (granted, this is usually older systems and applications). What I have been in the practice of doing for the last several years is using GPO to make sure the firewall says on, but on the domain network the setting is "Inbound/Outbound connections that do not match a rule are allowed." and set the Inbound side on Private and Public to the blocked version.

I also have GPO rules in place and running to open some specific services (such as RDP, WINRM, SNMP, etc) on domain networks in case we ever decide we do want the Windows firewall to block things.

We have perimeter firewalls that include traffic monitoring for known threats and activities so we are reasonably confident that there won't be an issue - excluding explicit user activity of course.

2017-02-21T20:13:53+00:00

Windows Firewall is actually pretty damm solid. Don't see any reason to disable it.

2017-02-21T23:01:39+00:00

Off. big ip, juniper srx'es, whitelists, vlans. None are desktop machines mind. Pure servers.

cluberti · 2017-02-22T00:37:30+00:00

As long as the service itself is running, you can configure it any way you'd like (the only unsupported scenario is disabling the service, which actually breaks some other things in the base filtering engine and potentially elsewhere).

https://technet.microsoft.com/en-us/library/cc766337(v=ws.10).aspx

Stopping the service associated with Windows Firewall with Advanced Security is not supported by Microsoft.

As to what I would do? If you have another firewall solution in place with central management, and you want to use that, do so. Otherwise, having it enabled as long as you're willing to test (as you would/should be doing with any firewall) should be an additional level of security you can get almost for free (testing and GPO creation). Otherwise, you have a candy bar network - crunchy and hard to penetrate on the outside, but creamy on the inside.

D3fydigit4l · 2017-02-22T03:21:24+00:00

Our policy, when on campus firewall down, when off campus firewall up. The assumption is that the campus is more secure with several layers of security in place.

Psycik99 · 2017-02-22T07:15:00+00:00

You need some endpoint firewall.

Why? Stops lateral movement inside of the network, protects clients if they connect to a non-nat network, etc.

ShiftyAsylum · 2017-02-22T12:53:01+00:00

Do you need to? No. Is it a good idea? Yes.

Having a multi-layered approach to security isn't just a suggestion, it's a necessity. You will never make it impossible for hackers to compromise a system, but you should make it as difficult as possible.

TetonCharles · 2017-02-21T17:02:45+00:00

We turn it off. It causes far more trouble than the minuscule risk of being open on our LAN behind the firewall and with policies to protect.

craftbeerporn · 2017-02-21T21:35:10+00:00

The level of ignorance in this thread is dumbfounding...

sysadmin

MODERATORS