Problem overview
Many organizations struggle to ensure that Windows Firewall remains consistently active across all network profiles, leaving devices vulnerable to threats. This script resolves the issue by quickly detecting whether any firewall profile is enabled, so administrators can immediately address potential security gaps.
PowerShell 100s timeout Runs as Local system Windows
<#
This resource is provided as a convenience for Level users. We cannot
guarantee it will work in all environments. Please test before deploying
to your production environment. We welcome contributions to our community
library
Level Library
https://level.io/library/script-windows-monitor-firewall
#>
# Function to check the status of Windows Firewall for all profiles
function Check-FirewallStatus {
$hasActiveProfile = $false
$profiles = Get-NetFirewallProfile
foreach ($profile in $profiles) {
$status = $profile.Enabled
$name = $profile.Name
if ($status -eq $true) {
Write-Host "$name profile firewall is ENABLED."
$hasActiveProfile = $true
}
else {
Write-Host "$name profile firewall is DISABLED."
}
}
return $hasActiveProfile
}
# Check firewall status for all profiles and store the result
$firewallActive = Check-FirewallStatus
# Determine script exit code based on firewall status
if ($firewallActive) {
Write-Host "SUCCESS: At least one firewall profile is active."
exit 0
}
else {
Write-Host "ALERT: No active firewall profiles detected."
exit 1
}The script examines the status of each Windows Firewall profile—domain, private, and public. If it finds even one profile with its firewall enabled, it returns a success message and a zero exit code; otherwise, it delivers an alert and exits with a non-zero code, triggering any follow-up actions within Level. By scanning multiple profiles, it provides a comprehensive firewall assessment without additional manual checks.
Use cases
- Verifying that Windows Firewall remains enabled after software updates
- Alerting administrators immediately if no firewall profiles are active
- Enhancing security for remote or hybrid workforce endpoints
- Integrating with automated remediation workflows that can re-enable the firewall
Recommendations
- Configure a script-based monitor in Level to periodically run this script and alert on inactive firewalls
- Pair with an automation remediation process to automatically enable the firewall if disabled
- Test the script on a non-production system first to confirm the logic matches your environment
- Customize output messages or logic for specific compliance standards or organizational policies