This script deliberately restricts SMB and RDP to the Private network profile.
This is a security best practice.
SMB (TCP 445) and RDP (TCP 3389) are:
- High‑value targets for worms, ransomware, and brute‑force attacks
- Historically abused when exposed to public networks
- Frequently scanned by automated bots
Exposing these services on Public networks dramatically increases risk.
- Allowed on trusted home LANs
- Blocked on:
- Public Wi‑Fi
- Coffee shops
- Hotels
- Airports
- Automatically enforced by Windows Firewall when the network profile changes
- Public: Explicitly untrusted
- Domain: Not applicable for home / workgroup setups
- Private: Designed specifically for trusted internal networks
✔ SMB and RDP work exactly as intended at home
✔ Exposure is automatically minimized
✔ No need to remember to “turn things off” later
This is the safest balance of usability and security.
Do not widen firewall scope unless you fully understand the risks.