{"id":25688,"date":"2025-07-21T08:34:14","date_gmt":"2025-07-21T08:34:14","guid":{"rendered":"https:\/\/www.newsbeep.com\/us\/25688\/"},"modified":"2025-07-21T08:34:14","modified_gmt":"2025-07-21T08:34:14","slug":"managing-windows-firewall-rules-with-powershell-part-3-creating-a-baseline","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/us\/25688\/","title":{"rendered":"Managing Windows Firewall Rules with PowerShell, Part 3: Creating a Baseline"},"content":{"rendered":"

[Editor’s Note: This is Part 3 of a three-part series on managing Windows firewall rules with PowerShell.]<\/p>\n

So far in this article series, I have shown you how to use PowerShell to manage Windows firewall rules<\/a>, and I have also explained how to gather more information<\/a> than what the Get-NetRirewallRule cmdlet can provide by itself. As handy as those techniques might be, however, you can take things further. By building on the techniques that I have already shown you, you can create a baseline of your firewall settings, and then you can compare your existing firewall settings to the baseline to see if anything has changed.<\/p>\n

Let me just say upfront that there are any number of tools and techniques that you could potentially use to document your baseline settings. For the purposes of this article, I am going to use a variation of the technique that I showed you in Part 2 to export my firewall rules to a CSV file. Here is my modified script:<\/p>\n

Get-NetFirewallRule | ForEach-Object {
\n$Rule = $_
\n$PortFilter = $Rule | Get-NetFirewallPortFilter
\n$AddressFilter = $Rule | Get-NetFirewallAddressFilter
\n[PSCustomObject]@{
\n\u00a0\u00a0\u00a0 Name\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = $Rule.DisplayName
\n\u00a0\u00a0\u00a0 Direction\u00a0\u00a0\u00a0\u00a0 = $Rule.Direction
\n\u00a0\u00a0\u00a0 Action\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 = $Rule.Action
\n\u00a0\u00a0\u00a0 Protocol\u00a0\u00a0\u00a0\u00a0\u00a0 = $PortFilter.Protocol
\n\u00a0\u00a0\u00a0 LocalPort\u00a0\u00a0\u00a0\u00a0 = $PortFilter.LocalPort
\n\u00a0\u00a0\u00a0 RemotePort\u00a0\u00a0\u00a0 = $PortFilter.RemotePort
\n\u00a0\u00a0\u00a0 LocalAddress\u00a0 = $AddressFilter.LocalAddress
\n\u00a0\u00a0\u00a0 RemoteAddress = $AddressFilter.RemoteAddress
\n\u00a0\u00a0 }
\n} | Export-CSV \u201cC:\\Temp\\FirewallRules.csv\u201d -NoTypeInformation<\/p>\n

As you can see, this script is very similar to the other one. However, instead of providing the script with the name of a firewall rule, we are using the Get-NetFirewallRule cmdlet to retrieve all of the firewall rules. The script then uses a ForEach loop to add each rule’s details to an array of custom objects, which is then exported to a CSV file after the loop ends.<\/p>\n

Related:What Is PowerShell?<\/a><\/p>\n

You can see the script and the resulting CSV file in Figure 1.<\/p>\n

\"\"<\/p>\n

Figure 1. The script has exported the firewall rules to a CSV file.<\/p>\n

Checking for Changes<\/p>\n

The important thing to keep in mind is that the CSV file that I have created represents my firewall rules as they existed at a particular point in time. That being the case, we can go back later and compare the machine’s firewall rules to the CSV file to find out if anything has changed.<\/p>\n

Here is the PowerShell script that I have created to compare the two CSV files:<\/p>\n

$Baseline = Import-Csv -Path “C:\\Temp\\FirewallRules.csv”
\n$Current\u00a0 = Import-Csv -Path “C:\\Temp\\CurrentFirewallRules.csv”
\n\u00a0
\nforeach ($BaseRule in $Baseline) {
\n\u00a0\u00a0\u00a0 $MatchExists = $False
\n\u00a0\u00a0\u00a0 $BaseName = $BaseRule.Name
\n\u00a0
\n\u00a0\u00a0\u00a0 ForEach ($Row in $Current) {
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 $CurrentRuleName = $Row.Name
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 If ($CurrentRuleName -eq $BaseName) {
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Write-Host “Checking rule: $CurrentRuleName” -ForegroundColor White
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 $MatchExists = $True
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 $FieldsToCompare = “Direction”, “Action”, “Protocol”, “LocalPort”, “RemotePort”, “LocalAddress”, “RemoteAddress”
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 $Differences = @()
\n\u00a0
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ForEach ($Field in $FieldsToCompare) {
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 $BaseValue = [string]$BaseRule.$Field
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 $CurrentValue = [string]$Row.$Field
\n\u00a0
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 if ($BaseValue -ne $CurrentValue) {
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 $Differences += “Field ‘$Field’ has changed from ‘$BaseValue’ to ‘$CurrentValue'”
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 }
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 }
\n\u00a0
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 if ($Differences.Count -gt 0) {
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Write-Host “Rule ‘$BaseName’ has changed:” -ForegroundColor Magenta
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 $Differences | ForEach-Object { Write-Host ”\u00a0\u00a0 $_” -ForegroundColor Cyan}
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 }
\n\u00a0
\n\u00a0
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 }
\n\u00a0\u00a0\u00a0 }
\n\u00a0
\n\u00a0\u00a0\u00a0 If (-Not $MatchExists) {
\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Write-Host “The rule ‘$BaseName’ has been deleted from the current firewall configuration.” -ForegroundColor Yellow
\n\u00a0\u00a0\u00a0 }
\n}<\/p>\n

As you can see, the script starts out by defining the path and filename for the baseline CSV file and for the current CSV file (the CSV file that was most recently created).<\/p>\n

Next, the script creates a ForEach loop that looks at all of the rules within the baseline CSV file. For each of these rules, the script initially sets the $MatchExists variable to False, indicating that the current rule has not yet been matched to any records within the CurrentFirewallRules.csv file. I have also created a variable called $BaseName that stores the name of the current rule.<\/p>\n

Next, the script goes into a nested ForEach loop. This loop examines all of the records within the CurrentFirewallRules.csv file to see if any of those records have a name that matches the name of the current baseline record. Assuming that a match is found, the script displays a line of text conveying the name of the record that is currently being checked. It also sets the $MatchExists variable to True. A third ForEach loop compares all of the various columns of data associated with the current record and its match, as a way of checking whether or not any changes have been made.<\/p>\n

Related:PowerShell Remoting in a Workgroup Environment: A Step-by-Step Guide<\/a><\/p>\n

If changes are detected, they are documented in an array called Differences. The script will display a message indicating the name of the firewall rule that has been modified, and then it will display the contents of the $Differences array. The reason why I am using an array is because a single firewall rule could potentially contain multiple modifications, and using an array makes it easy to display all of the modifications that are detected.<\/p>\n

The last thing that the script does for each of the baseline records is check to see if the $MatchExists variable is still set to False. If the variable does have a value of False, it means that no matching rule was found, and the script will display a message indicating that the rule has been deleted. You can see what the script looks like in Figure 2.<\/p>\n

Related:PowerShell Arrays: How To Build, Manipulate, and Manage Them<\/a><\/p>\n

\"\"<\/p>\n

Figure 2. This is what it looks like when the script runs.<\/p>\n

Even though this script works, there is room for improvement. As it is written, the script does not check to see if any new rules have been created since the baseline was compiled. More importantly, the script assumes that none of the firewall rules has a duplicate name. If your firewall contains two or more rules with the same name, then those duplications have the potential to confuse the script, resulting in false modification alerts.<\/p>\n

If there is enough interest, I may eventually create a version of this script that can perform a two-way comparison between the files and handle duplicate rule names.<\/p>\n

\u00a0<\/p>\n

\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"[Editor’s Note: This is Part 3 of a three-part series on managing Windows firewall rules with PowerShell.] So…\n","protected":false},"author":2,"featured_media":25689,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[46],"tags":[191,74],"class_list":{"0":"post-25688","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-computing","8":"tag-computing","9":"tag-technology"},"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/25688","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/comments?post=25688"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/posts\/25688\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media\/25689"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/media?parent=25688"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/categories?post=25688"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/us\/wp-json\/wp\/v2\/tags?post=25688"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}