topic Re: Using Compliance blade to check Windows registry for Windows Firewall rules in Endpoint

Using Compliance blade to check Windows registry for Windows Firewall rules

Luiz_ — Thu, 07 Jul 2022 14:35:40 GMT

Hi there checkmates,

We are trying to create a Compliance rule to check if a specific Windows Defender Firewall rule is present on the user's laptop.

The registry folder where the rules are located is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules.

The challenge is: the 'name' for each registry is randomized, a value like "{0E69F20E-9517-4D89-A9AB-603E27C8891F}". We can't find a way to check all registries because of that, we would need to use wildcard to do that and we aren't able to do that according to our tests.

Screenshot is attached with the configuration, where we would use * on the "Registry value name" field.

We have an open case with TAC for almost two weeks trying to get this answer but it doesn't go anywhere.

Any ideas? Thanks a lot.

Re: Using Compliance blade to check Windows registry for Windows Firewall rules

PhoneBoy — Sun, 10 Jul 2022 22:10:36 GMT

Is this with Harmony Connect or Harmony Endpoint managed via the cloud?

Re: Using Compliance blade to check Windows registry for Windows Firewall rules

Luiz_ — Sun, 10 Jul 2022 23:06:04 GMT

It's Harmony Endpoint managed via the cloud

Re: Using Compliance blade to check Windows registry for Windows Firewall rules

PhoneBoy — Tue, 12 Jul 2022 12:53:28 GMT

@jcortez can you think of a better way to do what's trying to be done here?

Re: Using Compliance blade to check Windows registry for Windows Firewall rules

jcortez — Tue, 12 Jul 2022 16:15:30 GMT

@PhoneBoy & @Luiz_

That is a very good question. Due to the fact that the Registry Key values a randomized it would be very difficult to achieve this. I honestly cannot think of a good workaround.

Let me have some of our internal resources take a look at this and I will reply back.

Re: Using Compliance blade to check Windows registry for Windows Firewall rules

jcortez — Tue, 12 Jul 2022 23:28:41 GMT

@PhoneBoy & @Luiz_

After speaking with our internal resources the only workaround that could work is creating a wildcard test in a script and using our Compliance Blade to run the script periodically.

Re: Using Compliance blade to check Windows registry for Windows Firewall rules

Luiz_ — Wed, 13 Jul 2022 16:32:33 GMT

Very good idea! Thanks a lot!

We're going to try this way.