Home
%3CLINGO-SUB%20id%3D%22lingo-sub-894414%22%20slang%3D%22en-US%22%3EManage%20Windows%20Defender%20Firewall%20with%20Microsoft%20Defender%20ATP%20and%20Intune%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-894414%22%20slang%3D%22en-US%22%3E%3CH1%20id%3D%22toc-hId-2021304321%22%20id%3D%22toc-hId-2021304321%22%3E%3CSPAN%3EManage%20Windows%20Defender%20Firewall%20with%20Microsoft%20Defender%20ATP%20and%20Intune%3C%2FSPAN%3E%26nbsp%3B%3C%2FH1%3E%0A%3CP%3EOne%20of%20the%20best%20ways%20you%20can%20improve%20the%20security%20posture%20of%20your%20organization%20is%20to%20use%20a%20firewall.%20Firewalls%20help%20prevent%20unauthorized%20incoming%20and%20outgoing%20network%20traffic.%20Windows%20Defender%20Firewall%20is%20included%20in%20Windows%2010%20and%20includes%20robust%20capabilities%20to%20manage%20network%20traffic%20to%20and%20from%20devices.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%E2%80%99re%20excited%20to%20announce%20new%20capabilities%20in%20in%20Microsoft%20Defender%20ATP%20and%20Intune%20to%20help%20you%20manage%20Windows%20Defender%20Firewall%20controls.%20New%20capabilities%20include%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSTRONG%3ECustom%20Firewall%20rules%3C%2FSTRONG%3E%3A%20define%20your%20own%20custom%20rules%20for%20Windows%20Defender%20Firewall%2C%20helping%20you%20block%20traffic%20across%20different%20profiles%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3ECustom%20Reporting%20by%20using%20Power%20BI%3C%2FSTRONG%3E%3A%20build%20your%20own%20custom%20reports%20that%20are%20specific%20for%20your%20needs%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CFONT%20size%3D%224%22%3E%3CSTRONG%3ECreate%20custom%20rules%20for%20Windows%20Defender%20Firewall%3C%2FSTRONG%3E%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3EYou%20can%20create%20custom%20Windows%20Defender%20Firewall%20rules%20to%20allow%20or%20block%20inbound%20or%20outbound%20across%20three%20profiles%20%E2%80%93%20Domain%2C%20Private%2C%20Public%20over%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CSTRONG%3EApplication%3C%2FSTRONG%3E%3A%20You%20can%20specify%20the%20file%20path%2C%20Windows%20service%2C%20or%20Package%20family%20name%20to%20control%20connections%20for%20an%20app%20or%20program.%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3EIP%20address%3C%2FSTRONG%3E.%20You%20can%20specify%20the%20local%20or%20remote%20addresses%20to%20which%20the%20rule%20applies.%20The%20IP%20address%20can%20support%20a%20single%20IP%20address%20or%20a%20range%20of%20IP%20addresses.%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3EPort%20and%20Protocol%3C%2FSTRONG%3E.%20You%20can%20specify%20the%20local%20and%20remote%20ports%20and%20the%20protocol%20to%20which%20this%20rule%20applies%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3EInterface%20types%3C%2FSTRONG%3E.%20You%20can%20control%20connections%20based%20on%20the%20interface%20types%20including%20Remote%20access%2C%20Wireless%2C%20and%20Local%20area%20network.%3C%2FLI%3E%0A%3CLI%3E%3CSTRONG%3EUsers%3C%2FSTRONG%3E.%20You%20can%20control%20from%20whom%20the%20connections%20are%20allowed.%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3EWindows%20Defender%20Firewall%20rule%20authoring%20capability%20is%20available%20in%20Microsoft%20Intune%20under%3CSTRONG%3E%20Endpoint%20protection%20%26gt%3B%20Microsoft%20Defender%20Firewall%20%26gt%3B%20Firewall%20rules%3C%2FSTRONG%3E.%20For%20more%20information%2C%20see%3A%26nbsp%3B%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fprotect%2Fendpoint-protection-configure%23add-custom-firewall-rules-for-windows-10-devices%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3EAdd%20custom%20Firewall%20rules%20for%20Windows%2010%20devices%3C%2FA%3E.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F135493i105AE093A8FEE854%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Firewall%20GA.jpg%22%20title%3D%22Firewall%20GA.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CFONT%20size%3D%224%22%3E%3CSTRONG%3ECustom%20Reporting%20using%20Power%20BI%20%3C%2FSTRONG%3E%3C%2FFONT%3E%3C%2FP%3E%0A%3CP%3EYou%20can%20view%20Windows%20Defender%20Firewall%20activities%20by%20%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2Fmicrosoft%2FMDATP-PowerBI-Templates%2Ftree%2Fmaster%2FFirewall%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Esetting%20up%20a%20custom%20report%20using%20Power%20BI%3C%2FA%3E.%20By%20doing%20so%2C%20you%20can%20monitor%20Windows%20Firewall%20activities%20over%20remote%20IP%2C%20Remote%20Port%2C%20Local%20Port%2C%20Local%20IP%2C%20Computer%20Name%2C%20Process%20across%20inbound%20connections%20and%20outbound%20connections.%3C%2FP%3E%0A%3CP%3EFirst%2C%20you%20must%20enable%20%3CSTRONG%3EAudit%20Events%3C%2FSTRONG%3E%20for%20Windows%20Defender%20Firewall%20with%20Advanced%20Security%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EAudit%20Filtering%20Platform%20Packet%20Drop%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows%2Fsecurity%2Fthreat-protection%2Fauditing%2Faudit-filtering-platform-packet-drop%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows%2Fsecurity%2Fthreat-protection%2Fauditing%2Faudit-filtering-platform-packet-drop%3C%2FA%3E%3C%2FLI%3E%0A%3CLI%3EAudit%20Filtering%20Platform%20Connection%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows%2Fsecurity%2Fthreat-protection%2Fauditing%2Faudit-filtering-platform-connection%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows%2Fsecurity%2Fthreat-protection%2Fauditing%2Faudit-filtering-platform-connection%3C%2FA%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3EEnable%20these%20events%20by%20using%20Group%20Policy%20Object%20Editor%2C%20Local%20Security%20Policy%2C%20or%20the%20auditpol.exe%20command%3A%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows%2Fwin32%2Ffwp%2Fauditing-and-logging%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows%2Fwin32%2Ffwp%2Fauditing-and-logging%3C%2FA%3E%3C%2FP%3E%0A%3CP%3EAfter%20enabling%20the%20events%2C%20Microsoft%20Defender%20ATP%20will%20start%20to%20monitor%20the%20data.%20You%20can%20then%20download%20the%20%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2Fmicrosoft%2FMDATP-PowerBI-Templates%2Ftree%2Fmaster%2FFirewall%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3ECustom%20Reporting%20script%3C%2FA%3E%20to%20monitor%20the%20Windows%20Defender%20Firewall%20activities.%20In%20the%20reports%2C%20you%E2%80%99ll%20see%20a%20summary%20of%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3Ehow%20many%20inbound%2Foutbound%20connections%20blocked%20in%20the%20last%2030%20days%3C%2FLI%3E%0A%3CLI%3Etop%2010%20local%20ports%20that%20were%20blocked%20the%20most%20in%20the%20last%2030%20days%3C%2FLI%3E%0A%3CLI%3Eaggregated%20information%20about%20processes%20linked%20to%20blocked%20inbound%2Foutbound%20connections%3C%2FLI%3E%0A%3CLI%3Einformation%20about%20the%20computers%20with%20blocked%20inbound%2Foutbound%20connections%3C%2FLI%3E%0A%3CLI%3Eremote%20IPs%20attempting%20to%20connect%20with%20multiple%20local%20computers%3C%2FLI%3E%0A%3CLI%3Etop%2010%20remote%20IPs%20with%20the%20most%20connection%20attempts%3C%2FLI%3E%0A%3CLI%3Einformation%20of%20applications%20linked%20to%20inbound%2Foutbound%20connections%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F135494i93CDF658F0E06AB4%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Firewall%20Report%20GA.jpg%22%20title%3D%22Firewall%20Report%20GA.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFor%20more%20information%20about%20Windows%20Defender%20Firewall%20management%2C%20see%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fprotect%2Fendpoint-protection-configure%23add-custom-firewall-rules-for-windows-10-devices%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3ECustom%20Firewall%20rules%20in%20Intune%20and%20Microsoft%20Defender%20ATP%3C%2FA%3E%3C%2FLI%3E%0A%3CLI%3E%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2Fmicrosoft%2FMDATP-PowerBI-Templates%2Ftree%2Fmaster%2FFirewall%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3ECustom%20Reporting%20using%20Power%20BI%3C%2FA%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-894414%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSTRONG%3EManage%20%3C%2FSTRONG%3Eand%20report%20on%20Windows%20Defender%20Firewall%20activities%20with%20new%20capabilities%20in%20Microsoft%20Defender%20ATP%20and%20Intune%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F135482i314A24A3EAC7D8A8%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Firewall%20GA.jpg%22%20title%3D%22Firewall%20GA.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-894414%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EWindows%20Defender%20Firewall%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Microsoft

Manage Windows Defender Firewall with Microsoft Defender ATP and Intune 

One of the best ways you can improve the security posture of your organization is to use a firewall. Firewalls help prevent unauthorized incoming and outgoing network traffic. Windows Defender Firewall is included in Windows 10 and includes robust capabilities to manage network traffic to and from devices.

 

We’re excited to announce new capabilities in in Microsoft Defender ATP and Intune to help you manage Windows Defender Firewall controls. New capabilities include:

  • Custom Firewall rules: define your own custom rules for Windows Defender Firewall, helping you block traffic across different profiles
  • Custom Reporting by using Power BI: build your own custom reports that are specific for your needs

 

Create custom rules for Windows Defender Firewall

You can create custom Windows Defender Firewall rules to allow or block inbound or outbound across three profiles – Domain, Private, Public over:

  • Application: You can specify the file path, Windows service, or Package family name to control connections for an app or program.
  • IP address. You can specify the local or remote addresses to which the rule applies. The IP address can support a single IP address or a range of IP addresses.
  • Port and Protocol. You can specify the local and remote ports and the protocol to which this rule applies
  • Interface types. You can control connections based on the interface types including Remote access, Wireless, and Local area network.
  • Users. You can control from whom the connections are allowed.

Windows Defender Firewall rule authoring capability is available in Microsoft Intune under Endpoint protection > Microsoft Defender Firewall > Firewall rules. For more information, see:  Add custom Firewall rules for Windows 10 devices.

Firewall GA.jpg

 

Custom Reporting using Power BI

You can view Windows Defender Firewall activities by setting up a custom report using Power BI. By doing so, you can monitor Windows Firewall activities over remote IP, Remote Port, Local Port, Local IP, Computer Name, Process across inbound connections and outbound connections.

First, you must enable Audit Events for Windows Defender Firewall with Advanced Security:

Enable these events by using Group Policy Object Editor, Local Security Policy, or the auditpol.exe command: https://docs.microsoft.com/en-us/windows/win32/fwp/auditing-and-logging

After enabling the events, Microsoft Defender ATP will start to monitor the data. You can then download the Custom Reporting script to monitor the Windows Defender Firewall activities. In the reports, you’ll see a summary of:

  • how many inbound/outbound connections blocked in the last 30 days
  • top 10 local ports that were blocked the most in the last 30 days
  • aggregated information about processes linked to blocked inbound/outbound connections
  • information about the computers with blocked inbound/outbound connections
  • remote IPs attempting to connect with multiple local computers
  • top 10 remote IPs with the most connection attempts
  • information of applications linked to inbound/outbound connections

Firewall Report GA.jpg

 

For more information about Windows Defender Firewall management, see: