PowerShell Version 2 Compatible Function to Determine Windows Firewall State

I recently had a need to perform some security auditing on an environment that still has some servers running PowerShell version 2 (PowerShell version 2 is deprecated). One of the things I needed to determine was whether or not the Windows firewall was enabled on each of the servers in the environment. Luckily, all of the servers at least had PowerShell remoting enabled.

#Requires -Version 2.0
function Get-MrNetFirewallState {

<#
.SYNOPSIS
Displays the per-profile state of the Windows Firewall.

.DESCRIPTION
The Get-MrNetFirewallState function displays the current firewall state for the Domain, Private, and Public profiles.

.PARAMETER ComputerName
The name of the computer(s) to retrieve the firewall state for.

.PARAMETER Credential
Specifies a user account that has permission to perform this action. The default is the current user.

.EXAMPLE
Get-MrNetFirewallState

.EXAMPLE
Get-MrNetFirewallState -ComputerName Server01, Server02

.EXAMPLE
Get-MrNetFirewallState -ComputerName Server01, Server02 -Credential (Get-Credential)

.INPUTS
None

.OUTPUTS
PSCustomObject

.NOTES
Author:  Mike F Robbins
Website: https://mikefrobbins.com
Twitter: @mikefrobbins
#>

[CmdletBinding()]
param (
[ValidateNotNullOrEmpty()]
[string[]]$ComputerName = $env:COMPUTERNAME,

[System.Management.Automation.Credential()]$Credential = [System.Management.Automation.PSCredential]::Empty
)

$ScriptBlock =
@'
$Results = netsh.exe advfirewall show allprofiles | Select-String -SimpleMatch Profile, State

for ($i = 0; $i -lt 6; $i += 2) {
New-Object PSObject -Property @{
ComputerName = $env:COMPUTERNAME
Name = ($Results[$i] | Select-String -SimpleMatch 'Profile Settings') -replace '^*.Profile Settings:'
Enabled = if ($Results[$i+1] -match 'ON') {
$true
}
else {
$false
}
}
}
'@

$Params = @{
Scriptblock = [Scriptblock]::Create($ScriptBlock)
}

if ($ComputerName -ne $env:COMPUTERNAME) {

$Params.ComputerName = $ComputerName
$Params.ErrorAction = 'SilentlyContinue'
$Params.ErrorVariable = 'Problem'

if ($PSBoundParameters.Credential) {
$Params.Credential = $Credential
}

Invoke-Command @Params | Select-Object -Property ComputerName, Name, Enabled

foreach ($p in $Problem) {
if ($p.FullyQualifiedErrorId -match 'AccessDenied|LogonFailure') {
Write-Warning -Message "Access Denied when trying to connect to $($p.TargetObject)"
}
elseif ($p.FullyQualifiedErrorId -match 'NetworkPathNotFound') {
Write-Warning -Message "Unable to connect to $($p.targetobject)"
}
else {
Write-Warning -Message "An unexpected error has occurred when trying to connect to $($p.targetobject)"
}
}

}
else {
$Params.ScriptBlock.Invoke()
}

}

The PowerShell function shown in the previous code example is a wrapper for the Netsh.exe command. The commands that are going to be executed are stored in a here-string and then converted to a script block within the parameters hash table. It uses Invoke-Command to execute Netsh on the remote servers and them uses Select-String to parse down the data to only the lines that are necessary. The results are turned into a usable custom object in a For loop that uses Select-String again to parse out some of the unnecessary information from each of the remaining lines. If the credential parameter is specified, it’s also added to the parameters hash table. Splatting is used with Invoke-Command.

Custom error handling has been added to allow the function to take advantage of running against multiple computers at the same time via Invoke-Command while providing the user with feedback when errors occur such as being unable to connect to the remote computer.

netsh-firewall-wrapper4a.jpg

I found that two different errors (access denied and logon failure) can be returned which both mean access denied. During the last few months, I’ve performed a technical technical review on the “Windows Server 2016 Automation with PowerShell Cookbook”. Based on reviewing Thomas Lee’s PowerShell code, I learned that the Match operator can be used similarly to the Like operator except without the need to specify wildcard characters. I had previously only used it when I needed to specify a regular expression.

netsh-firewall-wrapper5a.jpg

If you’re going to use the GroupBy parameter of Format-Table, you have to sort by that property first.

Get-MrNetFirewallState -ComputerName FS1, FS2, SRV1, SRV2 |
Sort-Object -Property ComputerName |
Format-Table -GroupBy ComputerName

netsh-firewall-wrapper1a.jpg

If the function is run against the local computer, the script block is simply invoked. While this doesn’t cover all scenarios where the local computer could be specified, it’s a great option for testing against a local computer where PowerShell remoting isn’t enabled.

Get-MrNetFirewallState

netsh-firewall-wrapper2a.jpg

This task is much easier to accomplish with newer versions of PowerShell using the Get-NetFirewallProfile cmdlet which was introduced in PowerShell version 3.0.

Get-NetFirewallProfile -CimSession fs1, fs2, srv1, srv2 |
Sort-Object -Property PSComputerName |
Format-Table -Property PSComputerName, Name, Enabled -GroupBy PSComputerName

netsh-firewall-wrapper3a.jpg

Here’s a bonus tip: Even though commands such as Get-NetFirewallProfile don’t have a ComputerName parameter, a computer name can be specified with the CimSession parameter without needing to first create a CIM session. A CIM session will automatically be created behind the scenes using the WSMan protocol and then it will be automatically removed once the command completes (a special thanks to Richard Siddaway for clarifying this for me a few weeks ago).

The Get-MrNetFirewallState function shown in this blog article can be downloaded from my PowerShell repository on GitHub.

ยต