Windows Firewall Domain Firewall State On: How to Fix the CIS Finding for All Profiles

“Ensure ‘Windows Firewall: Domain: Firewall state’ is set to ‘On (recommended)'” is a CIS benchmark check that fails when policy does not turn on Windows Defender Firewall for the Domain profile. To fix it, set Firewall state to On for the Domain, Private and Public profiles in Group Policy, keep inbound connections on Block, and refresh policy.

Matching Private and Public items usually fail alongside it, so this guide covers all three.

What the scanner is actually detecting

This is a configuration check, not a missing patch, so there is no plugin ID to look up. The audit reads the Group Policy value that controls each firewall profile. The CIS benchmark ties each item to a registry value under the policies branch:

The numbers come from Tenable’s CIS Microsoft Windows Server 2022 v5.1.0 L1 audit and Wazuh’s cis_win2022 policy. Other benchmarks may number them differently. You will see these titles in Tenable compliance audits, where the item is evaluated as a registry setting, in Wazuh Security Configuration Assessment (SCA), and in other CIS-based tools such as Qualys Policy Compliance.

The scanners do not all treat a missing value the same way. Wazuh’s Windows Server 2022 policy passes the check when the policy key or the EnableFirewall value does not exist, and fails only when a policy sets the value to something other than 1. An audit that requires the value to be present fails until a GPO writes it. So two tools can disagree about the same host.

The neighbouring CIS items in the same numbering, 9.1.2 “Inbound connections: Block (default)” (DefaultInboundAction = 1) and 9.1.3 “Outbound connections: Allow (default)” (DefaultOutboundAction = 0), are set on the same property page, so fix them in the same change.

Real-world risk

CIS’s rationale is simple: with the firewall off, all traffic can reach the system, and an attacker has an easier path to any weakness in a network service. On its own, this is not an exploitable bug. The real exposure depends on what is listening. With the Domain profile off, every listening service on the host (SMB, RDP, WinRM, RPC, application and development ports) is reachable from anywhere on the internal network, which helps lateral movement. With the Public profile off, a laptop is exposed on hotel or café Wi-Fi.

Microsoft adds that turning the firewall off costs more than port filtering. You lose IPsec connection security rules, protection against network fingerprinting, Windows Service Hardening and boot-time filters. Keep it in proportion, though. A host with the firewall on and a broad “allow any” rule is barely better off, and an attacker who already has administrator rights can turn the firewall off. CIS rates the item Level 1 and lists its impact as none, because On is the Windows default.

How to confirm it on the host

From an elevated PowerShell prompt, compare what is actually enforced with what policy sets:

# Effective state (all stores combined)
Get-NetFirewallProfile -PolicyStore ActiveStore |
    Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction
netsh advfirewall show allprofiles state

# What Group Policy sets (what the CIS check reads)
Get-NetFirewallProfile -PolicyStore RSOP | Select-Object Name, Enabled, DefaultInboundAction
reg query "HKLMSOFTWAREPoliciesMicrosoftWindowsFirewall" /s /v EnableFirewall

# Which profile each network adapter is using
Get-NetConnectionProfile | Select-Object InterfaceAlias, NetworkCategory

Run without -PolicyStore, Get-NetFirewallProfile shows only the local persistent store, not the result of Group Policy, so always add ActiveStore or RSOP. Here is how to read the results:

• EnableFirewall 0x1 under all three profile keys: the item passes.
• No policy key or value: no GPO controls the firewall. The firewall may still be on locally, but a check that needs the policy value fails.
• EnableFirewall 0x0: a GPO is turning the firewall off. Run gpresult /scope computer /h C:Tempgp.html to find which GPO. Also check the older Administrative Templates setting “Windows Firewall: Protect all network connections”, which Microsoft documents as another way to switch a profile off.

How to fix it

Domain-joined hosts: Group Policy

1. Edit a GPO linked to the target computers. Go to Computer Configuration > Policies > Windows Settings > Security Settings > Windows Defender Firewall with Advanced Security (older consoles call it Windows Firewall with Advanced Security).
2. Open Windows Defender Firewall Properties. On the Domain Profile, Private Profile and Public Profile tabs, set Firewall state to On (recommended), Inbound connections to Block (default) and Outbound connections to Allow (default).
3. Run gpupdate /force on a test machine before letting the change reach everything.

You can write the same settings into a domain GPO from PowerShell:

Set-NetFirewallProfile -All -Enabled True -DefaultInboundAction Block -DefaultOutboundAction Allow `
    -PolicyStore corp.example.comServer-Firewall-Baseline

If the GPO is linked but the value never shows up on the host, work through why a GPO is not applying and how precedence decides before changing anything else.

Standalone and workgroup hosts: local Group Policy

Microsoft’s cmdlet reference accepts localhost as a policy store, which targets the computer’s local GPO. Run this from an elevated prompt:

Set-NetFirewallProfile -All -Enabled True -DefaultInboundAction Block -DefaultOutboundAction Allow -PolicyStore localhost

The GUI equivalent is gpedit.msc > Computer Configuration > Windows Settings > Security Settings > Windows Defender Firewall with Advanced Security. Microsoft notes that local Group Policy settings are stored in the same location as centrally managed ones, which is where the audit looks.

Scripted registry method

For images or scripted builds, you can write the policy values directly:

reg add "HKLMSOFTWAREPoliciesMicrosoftWindowsFirewallDomainProfile" /v EnableFirewall /t REG_DWORD /d 1 /f
reg add "HKLMSOFTWAREPoliciesMicrosoftWindowsFirewallPrivateProfile" /v EnableFirewall /t REG_DWORD /d 1 /f
reg add "HKLMSOFTWAREPoliciesMicrosoftWindowsFirewallPublicProfile" /v EnableFirewall /t REG_DWORD /d 1 /f
reg add "HKLMSOFTWAREPoliciesMicrosoftWindowsFirewallDomainProfile" /v DefaultInboundAction /t REG_DWORD /d 1 /f
reg add "HKLMSOFTWAREPoliciesMicrosoftWindowsFirewallPrivateProfile" /v DefaultInboundAction /t REG_DWORD /d 1 /f
reg add "HKLMSOFTWAREPoliciesMicrosoftWindowsFirewallPublicProfile" /v DefaultInboundAction /t REG_DWORD /d 1 /f

Prefer a GPO where you have one. Values written directly are harder to trace later, and a GPO that sets the same value wins at the next refresh.

Turning it on immediately

Microsoft’s documented commands enable the firewall on the local device:

Set-NetFirewallProfile -All -Enabled True
netsh advfirewall set allprofiles state on

These take effect right away, but they write to the local persistent store, not to a policy. A policy-based audit can still fail afterwards, and a GPO that sets the state to Off overrides them.

Before you enable it on servers

Make sure every legitimate inbound service has an allow rule first:

Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess
Get-NetFirewallRule -Direction Inbound -Enabled True -Action Allow | Select-Object DisplayName, Profile

New-NetFirewallRule -DisplayName "LOB app TCP 8443" -Direction Inbound -Protocol TCP -LocalPort 8443 `
    -RemoteAddress 10.20.0.0/16 -Action Allow -Profile Any

For servers that never move, Microsoft suggests scoping rules to all profiles. A disconnected network adapter is assigned the Public network location, and rules scoped only to Domain stop applying there. Keep out-of-band console access available when you change a remote server’s firewall. For the other settings that usually travel with this one, see the Windows Server hardening checklist.

How to verify the fix and rescan

gpupdate /force
Get-NetFirewallProfile -PolicyStore ActiveStore | Select-Object Name, Enabled, DefaultInboundAction
Get-NetFirewallProfile -PolicyStore RSOP | Select-Object Name, Enabled, DefaultInboundAction
reg query "HKLMSOFTWAREPoliciesMicrosoftWindowsFirewall" /s /v EnableFirewall

All three profiles should show Enabled True in both stores, and each profile key should hold EnableFirewall 0x1. Test from another machine that the services you need still answer. Then rerun the same credentialed compliance audit or SCA policy. Group Policy refreshes in the background every 90 minutes, plus a random 0 to 30 minute offset, so hosts you did not refresh by hand may need that long to pick up the change.

What can break and how to roll back

• Inbound services without rules: custom application ports, agents that listen for connections, and ping-based monitoring (unless an ICMP allow rule exists).
• Profile changes: a server that falls back to the Public profile applies Public rules, not Domain rules.
• IPsec sessions: Microsoft notes that firewall policy processing disconnects IPsec connections while filters are reapplied.

The right rollback is usually to add the missing allow rule, not to switch the firewall off. If you must revert, set Firewall state back to Not configured in the GPO and run gpupdate /force, or delete the values you added with reg delete … /v EnableFirewall /f. A local Set-NetFirewallProfile -Enabled False only works where no GPO sets the state. Do not stop the Windows Defender Firewall service (MpsSvc). Microsoft does not support it and warns it can break the Start menu, app installs and updates, and phone activation.

Common false positive reasons

• On locally, not by policy. The firewall is running but no GPO sets it. That is a correct result for the benchmark, so set it through policy rather than disputing it.
• Tools disagree. Wazuh passes when no policy value exists, while other audits fail. Compare the actual registry value, not the tool verdicts.
• Stale results. The scan ran before the GPO refresh, or the host was offline.
• Intune-managed devices. Firewall settings arrive through the Firewall CSP, not Group Policy. Confirm the effective state with the ActiveStore query and check that the audit matches how the device is managed (CIS publishes separate Intune benchmarks).
• Third-party firewall. This is an exception to document, not a false positive. Microsoft advises against disabling Windows Firewall for compatibility and says third-party products can disable only the rule types they need to.

FAQ

Do I need to reboot after turning the firewall on?

No. Windows Firewall watches its policy location in the registry and reapplies filters when it changes. Run gpupdate /force to pull the GPO immediately.

Is Set-NetFirewallProfile -All -Enabled True enough to pass the scan?

Not always. It writes to the local store, so add -PolicyStore localhost or use a GPO.

Why fix the Domain profile on a workgroup server?

The benchmark expects all three profiles on. It costs nothing, and it protects the host if its network category ever changes.

Can I stop the firewall service instead of changing the profile?

No. Stopping MpsSvc is unsupported. To disable filtering, Microsoft’s supported method is turning profiles off with the service still running.

Tracking this finding across many hosts

This item tends to fail in batches, often on every host built from the same image. SITEY, a self-hosted vulnerability management platform, imports findings from 16 scanners and merges duplicates within each scanner, not across different scanners. Its AI writes host-specific remediation scripts that run only after human approval; the platform’s agents deploy them on Windows endpoints and it re-tests afterwards to verify closure, although per-finding retest is limited to Nessus, Acunetix and Burp results.

Sources

• Tenable: 9.1.1 Ensure ‘Windows Firewall: Domain: Firewall state’ is set to ‘On (recommended)’ (CIS Windows Server 2022 v5.1.0 L1 MS)
• Wazuh: CIS Microsoft Windows Server 2022 SCA policy (cis_win2022.yml)
• Microsoft Learn: Manage Windows Firewall with the command line
• Microsoft Learn: Set-NetFirewallProfile
• Microsoft Learn: Windows Firewall tools and Group Policy processing considerations