Skip to content

Latest commit

 

History

History
54 lines (34 loc) · 1.21 KB

File metadata and controls

54 lines (34 loc) · 1.21 KB

Security Notes

Why Private‑Only Firewall Scoping Is Intentional

This script deliberately restricts SMB and RDP to the Private network profile.

This is a security best practice.


What Is the Risk?

SMB (TCP 445) and RDP (TCP 3389) are:

  • High‑value targets for worms, ransomware, and brute‑force attacks
  • Historically abused when exposed to public networks
  • Frequently scanned by automated bots

Exposing these services on Public networks dramatically increases risk.


What Private‑Only Means

  • Allowed on trusted home LANs
  • Blocked on:
    • Public Wi‑Fi
    • Coffee shops
    • Hotels
    • Airports
  • Automatically enforced by Windows Firewall when the network profile changes

Why Not Domain or Public?

  • Public: Explicitly untrusted
  • Domain: Not applicable for home / workgroup setups
  • Private: Designed specifically for trusted internal networks

Bottom Line

✔ SMB and RDP work exactly as intended at home
✔ Exposure is automatically minimized
✔ No need to remember to “turn things off” later

This is the safest balance of usability and security.


Recommendation

Do not widen firewall scope unless you fully understand the risks.