How to Audit and Manage Firewall Profiles in Windows 11 Using PowerShell Get-NetFirewallProfile

Windows 11 protects endpoints through the Windows Defender Firewall with Advanced Security subsystem, dividing network connections into three distinct security boundaries: Domain, Private, and Public profiles. While the standard graphical control panel provides basic toggles, it lacks programmatic auditing capabilities and granular logging controls. By leveraging PowerShell and the native NetSecurity module, system administrators and security-conscious users can inspect, audit, and configure all firewall profiles using the Get-NetFirewallProfile and Set-NetFirewallProfile cmdlets.

Understanding Windows 11 Firewall Profiles

Windows assigns active network adapters to a profile based on network location discovery:

• Domain: Applied automatically when the machine authenticates against an Active Directory domain controller.
• Private: Designed for trusted home or small office networks where file sharing and local device discovery (such as network printers) are permitted.
• Public: The strictest baseline, designed for untrusted public Wi-Fi networks in coffee shops, airports, and hotels. It isolates the computer by blocking incoming connection attempts and disallowing local network discovery by default.

Querying Firewall Profiles with Get-NetFirewallProfile

To inspect active profile policies, launch PowerShell or Windows Terminal as an administrator, then run:

Get-NetFirewallProfile

PowerShell outputs a comprehensive property list for all three profiles (Domain, Private, and Public). To condense this output into an easily readable diagnostic table, pipe the cmdlet through Format-Table:

Get-NetFirewallProfile | Format-Table Name, Enabled, DefaultInboundAction, DefaultOutboundAction, LogFileName

The resulting table displays whether each profile is currently active (True or False), its default handling for unsolicited incoming traffic (typically Block), its default outbound posture (typically Allow), and the filesystem location where dropped packets are logged.

Auditing Specific Security Profiles

If you want to focus exclusively on your machine’s posture when connected to untrusted public networks, target the Public profile directly:

Get-NetFirewallProfile -Name Public | Select-Object Name, Enabled, DefaultInboundAction, AllowInboundRules, AllowLocalFirewallRules, LogBlocked

Critical properties to evaluate include:

• DefaultInboundAction: Should reflect Block to deny unrequested ingress traffic.
• AllowInboundRules: Indicates whether designated rule exceptions can permit ingress packets. Setting this to False enforces a complete inbound shield.
• AllowLocalFirewallRules: Dictates whether local administrators or third-party applications can inject custom rules without domain policy approval.
• LogBlocked: Specifies whether dropped packets generate audit entries in security logs.

Configuring Profile Settings with Set-NetFirewallProfile

When audits reveal configuration drift or lax security baselines, use Set-NetFirewallProfile to harden the profile without navigating complex graphical menus.

1. Enforcing Default Inbound Blocking on Public Networks

To ensure that all incoming connection attempts are rejected unless an explicit administrative exception exists:

Set-NetFirewallProfile -Name Public -DefaultInboundAction Block

2. Enabling Dropped Packet Logging for Network Forensics

By default, Windows does not log dropped packets, making connection troubleshooting difficult. To enable logging for dropped packets on the Public profile and set a maximum log size:

Set-NetFirewallProfile -Name Public -LogBlocked True -LogMaxSizeKilobytes 16384 -LogFileName "$env:SystemRoot\System32\LogFiles\Firewall\pfirewall.log"

3. Disabling Merged Local Firewall Rules

In managed corporate or secure environments where only central administrators should define firewall behaviour, prevent local applications from creating permissive firewall exceptions:

Set-NetFirewallProfile -Name Domain, Private -AllowLocalFirewallRules False

Verifying Profile State and Connectivity Post-Configuration

After applying policy updates, re-run Get-NetFirewallProfile to confirm that all parameters reflect your desired security posture. Scripting these queries within PowerShell enables rapid endpoint auditing across multiple Windows 11 workstations, ensuring that device perimeters remain fortified against unauthorized network intrusion.