Audit firewall profiles
Documentation: Microsoft Learn
Get-NetFirewallProfile returns one object per profile, and Select-Object reports the profile name with Enabled plus the two default action fields.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-NetFirewallProfile | Select-Object Name,Enabled,DefaultInboundAction,DefaultOutboundAction- Stage 1Get-NetFirewallProfile
Positional values or no named parameters - Stage 2Select-Object
Positional values or no named parameters
How it works
Get-NetFirewallProfile returns one object per profile, and Select-Object reports the profile name with Enabled plus the two default action fields. Three rows cover the whole posture.
Adapting it
Piping into Where-Object Enabled -eq $false reduces the output to an exception list, which is the shape a compliance report actually wants to consume.
If the result is unexpected
A profile shows as disabled, enabling it locally has no effect after the next policy refresh, or all three profiles report values nobody configured.
The effective settings reported here are the result of merging local configuration with any Group Policy store, and policy wins that merge. A local change therefore appears to take and is overwritten at the next refresh. A third-party firewall registering with Windows can also switch the profiles off as part of its own installation.
- Read the ActiveStore explicitly with -PolicyStore and compare it against the PersistentStore.
- Run gpresult /h and find the Windows Firewall section to identify which GPO is setting the value.
- Check for a registered third-party firewall through the SecurityCenter2 namespace.
- Make the change in the GPO that owns the setting rather than on the host.
- Confirm the Windows Defender Firewall service is running, because a stopped service reports profiles as disabled.
Validate the result
Querying the active store reports Enabled as True for all three profiles and the value survives a gpupdate /force.
Keep the check reliable
Manage firewall state through one GPO so there is a single place to look, and audit against the active store rather than the local configuration.
