From ebc22ff43e6a978d3a3ac2f43b4e546a78fe7b50 Mon Sep 17 00:00:00 2001 From: Nilanjana Ganguly <74384702+ngangulyms@users.noreply.github.com> Date: Fri, 29 Sep 2023 15:38:51 -0700 Subject: [PATCH 1/8] Learn Editor: Update best-practices-configuring.md --- .../best-practices-configuring.md | 31 +++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index a61bf25eec..6b3171e2a1 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -208,3 +208,34 @@ For tasks related to creating outbound rules, see [Checklist: Creating Outbound ## Document your changes When creating an inbound or outbound rule, you should specify details about the app itself, the port range used, and important notes like creation date. Rules must be well-documented for ease of review both by you and other admins. We highly encourage taking the time to make the work of reviewing your firewall rules at a later date easier. And *never* create unnecessary holes in your firewall. + +## Configure Windows Firewall rules with WDAG tagging policies + +Windows Firewall now supports the use of Windows Defender Application Control (WDAC) Application ID (AppID) tags in firewall rules. With this capability, Windows Firewall rules can now be scoped to an application or a group of applications by referencing process tags, without using absolute path or sacrificing security. There are two steps for this configuration: + +**Step 1: Deploy WDAC AppId Tagging Policies** + +A Windows Defender Application Control (WDAC) policy needs to be deployed which specifies individual applications or groups of applications to apply a PolicyAppId tag to the process token(s). Then, the admin can define firewall rules which are scoped to all processes tagged with the matching PolicyAppId.   + +Follow the detailed [WDAC Application ID (AppId) Tagging Guide](/windows/security/threat-protection/windows-defender-application-control/appidtagging/windows-defender-application-control-appid-tagging-guide) to create, deploy, and test an AppID (Application ID) policy to tag applications.  + +**Step 2: Configure Firewall Rules using PolicyAppId Tags**  + +- **Deploy firewall rules with Intune:** When creating firewall rules with Intune Microsoft Defender Firewall Rules, provide the AppId tag in the Policy App ID setting. The properties come directly from the [Firewall configuration service provider ](/windows/client-management/mdm/firewall-csp)(CSP) and apply to the Windows platform. +You can do this through the Intune admin center under Endpoint security > Firewall. Policy templates can be found via Create policy > Windows 10, Windows 11, and Windows Server > Microsoft Defender Firewall or Microsoft Defender Firewall Rules. + +OR + +- **Create local firewall rules with PowerShell**: You can use PowerShell to configure by adding a Firewall rule using [New-NetFirewallRule](/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2022-ps) and specify the –PolicyAppId tag. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported.  + +> [!NOTE] +> WDAC AppId Tagging Policies are available on the following versions of the Windows platform:  +> +> - Windows 10, versions 20H1 and above  + +> - Windows 11  + +> - Windows Server 2022 and above  + +> + From b5ca81edd4f369cf9295aaf0852e87c9e5236675 Mon Sep 17 00:00:00 2001 From: Nilanjana Ganguly <74384702+ngangulyms@users.noreply.github.com> Date: Tue, 3 Oct 2023 14:20:22 -0700 Subject: [PATCH 3/8] Update best-practices-configuring.md removed notes for editions --- .../windows-firewall/best-practices-configuring.md | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index 6b3171e2a1..2f4aaaafc8 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -228,14 +228,4 @@ OR - **Create local firewall rules with PowerShell**: You can use PowerShell to configure by adding a Firewall rule using [New-NetFirewallRule](/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2022-ps) and specify the –PolicyAppId tag. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported.  -> [!NOTE] -> WDAC AppId Tagging Policies are available on the following versions of the Windows platform:  -> -> - Windows 10, versions 20H1 and above  - -> - Windows 11  - -> - Windows Server 2022 and above  - -> From 477d5ea2f7769124f0413f46fcbe90fb01a88563 Mon Sep 17 00:00:00 2001 From: Nilanjana Ganguly <74384702+ngangulyms@users.noreply.github.com> Date: Tue, 3 Oct 2023 14:29:38 -0700 Subject: [PATCH 4/8] Update best-practices-configuring.md url correction --- .../windows-firewall/best-practices-configuring.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index 2f4aaaafc8..cc0305632e 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -226,6 +226,6 @@ You can do this through the Intune admin center under Endpoint security > Firewa OR -- **Create local firewall rules with PowerShell**: You can use PowerShell to configure by adding a Firewall rule using [New-NetFirewallRule](/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2022-ps) and specify the –PolicyAppId tag. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported.  +- **Create local firewall rules with PowerShell**: You can use PowerShell to configure by adding a Firewall rule using [New-NetFirewallRule](/powershell/module/netsecurity/new-netfirewallrule) and specify the –PolicyAppId tag. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported.  From 090e7ae13bf9aff5fa085c7070f5cf91672bddc6 Mon Sep 17 00:00:00 2001 From: Nilanjana Ganguly <74384702+ngangulyms@users.noreply.github.com> Date: Tue, 3 Oct 2023 14:30:15 -0700 Subject: [PATCH 5/8] Update best-practices-configuring.md --- .../windows-firewall/best-practices-configuring.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index cc0305632e..0eab04c64d 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -209,7 +209,7 @@ For tasks related to creating outbound rules, see [Checklist: Creating Outbound When creating an inbound or outbound rule, you should specify details about the app itself, the port range used, and important notes like creation date. Rules must be well-documented for ease of review both by you and other admins. We highly encourage taking the time to make the work of reviewing your firewall rules at a later date easier. And *never* create unnecessary holes in your firewall. -## Configure Windows Firewall rules with WDAG tagging policies +## Configure Windows Firewall rules with WDAC tagging policies Windows Firewall now supports the use of Windows Defender Application Control (WDAC) Application ID (AppID) tags in firewall rules. With this capability, Windows Firewall rules can now be scoped to an application or a group of applications by referencing process tags, without using absolute path or sacrificing security. There are two steps for this configuration: From ac951fcbdc940aa4513476e37ae79df953a220ed Mon Sep 17 00:00:00 2001 From: Nilanjana Ganguly <74384702+ngangulyms@users.noreply.github.com> Date: Wed, 11 Oct 2023 10:51:49 -0700 Subject: [PATCH 6/8] Update windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md Co-authored-by: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> --- .../windows-firewall/best-practices-configuring.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index 0eab04c64d..37c7bd40cd 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -213,7 +213,7 @@ When creating an inbound or outbound rule, you should specify details about the Windows Firewall now supports the use of Windows Defender Application Control (WDAC) Application ID (AppID) tags in firewall rules. With this capability, Windows Firewall rules can now be scoped to an application or a group of applications by referencing process tags, without using absolute path or sacrificing security. There are two steps for this configuration: -**Step 1: Deploy WDAC AppId Tagging Policies** +### Step 1: Deploy WDAC AppId Tagging Policies A Windows Defender Application Control (WDAC) policy needs to be deployed which specifies individual applications or groups of applications to apply a PolicyAppId tag to the process token(s). Then, the admin can define firewall rules which are scoped to all processes tagged with the matching PolicyAppId.   From 3819fb16e3dcd5666c337098380a971a8c8fda46 Mon Sep 17 00:00:00 2001 From: Nilanjana Ganguly <74384702+ngangulyms@users.noreply.github.com> Date: Wed, 11 Oct 2023 10:52:06 -0700 Subject: [PATCH 7/8] Update windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md Co-authored-by: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> --- .../windows-firewall/best-practices-configuring.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index 37c7bd40cd..9db1183c80 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -219,7 +219,7 @@ A Windows Defender Application Control (WDAC) policy needs to be deployed which Follow the detailed [WDAC Application ID (AppId) Tagging Guide](/windows/security/threat-protection/windows-defender-application-control/appidtagging/windows-defender-application-control-appid-tagging-guide) to create, deploy, and test an AppID (Application ID) policy to tag applications.  -**Step 2: Configure Firewall Rules using PolicyAppId Tags**  +### Step 2: Configure Firewall Rules using PolicyAppId Tags - **Deploy firewall rules with Intune:** When creating firewall rules with Intune Microsoft Defender Firewall Rules, provide the AppId tag in the Policy App ID setting. The properties come directly from the [Firewall configuration service provider ](/windows/client-management/mdm/firewall-csp)(CSP) and apply to the Windows platform. You can do this through the Intune admin center under Endpoint security > Firewall. Policy templates can be found via Create policy > Windows 10, Windows 11, and Windows Server > Microsoft Defender Firewall or Microsoft Defender Firewall Rules. From 03f7d28f345d252eba145843d31783c67efa7bfe Mon Sep 17 00:00:00 2001 From: Nilanjana Ganguly <74384702+ngangulyms@users.noreply.github.com> Date: Wed, 11 Oct 2023 10:52:36 -0700 Subject: [PATCH 8/8] Update windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md Co-authored-by: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> --- .../windows-firewall/best-practices-configuring.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md index 9db1183c80..45c223f957 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/best-practices-configuring.md @@ -226,6 +226,6 @@ You can do this through the Intune admin center under Endpoint security > Firewa OR -- **Create local firewall rules with PowerShell**: You can use PowerShell to configure by adding a Firewall rule using [New-NetFirewallRule](/powershell/module/netsecurity/new-netfirewallrule) and specify the –PolicyAppId tag. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported.  +- **Create local firewall rules with PowerShell**: You can use PowerShell to configure by adding a Firewall rule using [New-NetFirewallRule](/powershell/module/netsecurity/new-netfirewallrule) and specify the `–PolicyAppId` tag. You can specify one tag at a time while creating firewall rules. Multiple User Ids are supported.