0

So, by default default, Windows client OSes (and servers too, to a degree) have 2 default Windows Firewall policies: weird local firewall and local group policy. In netsh you can easily switch between them:

netsh advfirewall set store gpo=COMUTERNAME
netsh advfirewall set store local

Default is always local.

What I can't figure out is what would be a proper path for local GPO in new cmdlets in powershell's "NetSecurity" module. The syntax is:

New-NetFirewallRule -DisplayName “Block Outbound Telnet” -Direction Outbound -Program %SystemRoot%\System32\tlntsvr.exe –Protocol TCP –LocalPort 23 -Action Block –PolicyStore domain\gpo_name

(taken from here)

I've tried COMPUTER\Local and COMPUTER\Local Group Policy but no dice. There has to be a way to see what is the proper path/name for local GPO.

1 Answer 1

0

New-NetFirewallRule has a lot of options for -PolicyStore, but to target the local host rules instead of a group policy object, just use either of these:

  • PersistentStore: to add it to a section of the local firewall policy for custom rules. Rules created in this store are attached to the ActiveStore and activated on the computer immediately:

    New-NetFirewallRule -PolicyStore PersistentStore
    
  • localhost: (not the computer name) to add the rule to the local group policy:

    New-NetFirewallRule -PolicyStore localhost
    
  • ActiveStore: to target the currently active store (Local by default)

     New-NetFirewallRule -PolicyStore ActiveStore
    

edit: I verified this command does create a rule in the local security policy:

New-NetFirewallRule -Name TestRule1 -DisplayName TestRule1 -Protocol TCP -LocalPort 5004 -Action Allow -Direction Inbound -PolicyStore localhost

You can view it with the same policystore

Get-NetFirewallRule -DisplayName Test* -PolicyStore LocalHost

However, this rule created from powershell in the localhost policystore don't seem to attach automatically to the ActiveStore. Get-NetFirewallRule -DisplayName Test* -PolicyStore ActiveStore will show rules created from the secpol UI, but not rules created from powershell. Maybe requires a restart or a different param to enable?

9
  • localhost: (not the computer name) to add the rule to the local group policy I've tried that already before asking the question: "New-NetFirewallRule: The network path was not found." I would not ask otherwise. For the record I did read already the docs on MS site
    – Digika
    May 9, 2022 at 23:14
  • @Digika yes I think I misunderstood, my pc does not have the gpo=computername store. Can you try checking all your rules for the usable store name like this? Get-NetFirewallRule | select policystoreSource,policystoreSourceType -Unique. If the store is empty, you may need to create a rule with netsh first
    – Cpt.Whale
    May 10, 2022 at 13:47
  • I did not mean gpo=computername as literal, you replace it with your computer name, This only works in netsh. If you want to more context, here is example: open "Windows Firewall with Advanced..." from your start menu. Add any rule. Open "Local Security Policy", go to Windows Defender Firewall - do you see that rule? These are 2 different store/sources. netsh allows you to switch and add into either but for *-NetFirewallRule I cant figure out the correct network name/syntax.
    – Digika
    May 10, 2022 at 15:22
  • If you add column "Rule Source" to the MMC panel you will see either "Local" or "Local Group Policy". The latter is what I want to access because by default *-NetFirewallRule adds to Local.
    – Digika
    May 10, 2022 at 15:41
  • 1
    It does not attach because by default, on client, rules arent merged. You need to enable Rule Merging in GPO Firewall Settings. This does not answer why I cant add to localhost. Have to hit the MS answers board.
    – Digika
    May 10, 2022 at 17:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .