Who rated this post

I've been troubleshooting an issue where the endpoint firewall is blocking traffic and this got me digging into the settings for the firewall and I discovered that the default settings are basically wide open, anything in, anything out!

This surprised me as even the Microsoft windows firewall blocks incoming traffic by default.

The policy itself at first glance looks ok:

The problem relates to the zones, the internet zone is everything that's not in the trusted zone, but the trusted zone, by default, looks like this:

I've not seen this documented anywhere and there is no mention of it in the course book for the CCES either!

I'm wondering how many people have deployed this on the assumption that it's default settings are safe!