Firewall rules, WDAC and BitLocker
Hardening a server means controlling the traffic it accepts, the code it runs and the data it stores. These three tools cover that on Windows Server.
Windows Defender Firewall with Advanced Security
The firewall has three profiles (Domain, Private, Public) and each has inbound and outbound rules. Default behaviour is to block inbound and allow outbound.
| Need | Create |
|---|---|
| Let a client reach an app on this server | Inbound rule (program or port) |
| Block a server from reaching a destination | Outbound rule |
| Allow ping | Inbound rule for ICMPv4 (File and Printer Sharing - Echo Request) |
| Require authentication or encryption between computers | Connection security rule |
Connection security rules use IPsec. An isolation rule restricts connections to computers that authenticate (for example domain members). A rule that requires encryption can break plain ICMP such as tracert, so you may need to add an exemption or an allow rule. Deploy rules with Group Policy for many servers.
Windows Defender Application Control (WDAC)
WDAC, now also called App Control for Business, is a code integrity policy. Instead of blocking known bad files, it allows only trusted code, based on signer, file hash or path. Policies can run in audit mode first. Use it when the requirement is to control what executes, including drivers, scripts or COM object registration. It is stronger than AppLocker and works at kernel level.
Do not confuse it with Smart App Control, a Windows client feature, or exploit protection, which mitigates memory attacks in a process.
BitLocker
BitLocker encrypts volumes. Servers usually use a TPM plus a protector such as a recovery password. Key points:
Enable-BitLocker -MountPoint D: -RecoveryPasswordProtector
Enable-BitLockerAutoUnlock -MountPoint D:- Auto-unlock only applies to fixed data volumes. The OS volume must be unlocked first.
- Back up the recovery password to AD DS with Group Policy.
Azure Disk Encryption
For Azure VMs, Azure Disk Encryption uses BitLocker inside Windows VMs. Keys are stored in Azure Key Vault, which must be in the same region and subscription as the VM and have the disk encryption access policy enabled.
Exam traps
- Inbound versus outbound rules. A server that receives connections needs an inbound rule.
- Connection security rules do not allow or block traffic by themselves. They add authentication or encryption.
- WDAC is about what runs. BitLocker is about data at rest.
- Auto-unlock does not work for the boot volume.
- A key vault in another region or subscription cannot be used for Azure Disk Encryption.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. An application on Server1 listens on TCP 8443 and users cannot connect. You want to open only that port for that application. What do you create in Windows Defender Firewall with Advanced Security?
Show answer
Answer: A.Traffic arriving at the server is controlled by an inbound rule. You can scope it to a program, port and remote addresses.
2. Which feature lets you block specific code, including DLLs and scripts, from running on a server by policy?
Show answer
Answer: A.WDAC (App Control for Business) allows only trusted code to run and can also restrict items such as COM objects through its policy.
3. Data volume D on a server is BitLocker-protected and must unlock automatically after a restart. Which cmdlet do you run?
Show answer
Answer: A.Auto-unlock works for data volumes once the operating system volume is also unlocked. It is enabled with Enable-BitLockerAutoUnlock.
4. You enable Azure Disk Encryption on a Windows VM. Which key vault can you use?
Show answer
Answer: B.The key vault must be in the same region and subscription as the VM and must allow disk encryption access.