1. Using Windows Firewall and Windows Defender
Lesson 7

2. Skills Matrix Technology Skill Objective Domain Skill Domain #
Understanding Windows Firewall
Troubleshoot Windows Firewall issues
2.3
Configuring Windows Firewall
Configuring Windows Firewall Basic Settings
Configure system exceptions
Configuring Windows Firewall with Advanced Security and Group Policy Settings
Skills Matrix

3. Skills Matrix Technology Skill Objective Domain Skill Domain #
Understanding Windows Defender
Troubleshoot Windows Defender issues
2.4
Using Windows Defender
Configuring Windows Defender Options Locally
Skills Matrix

4. Skills Matrix Technology Skill Objective Domain Skill Domain #
Using Software Explorer
Troubleshoot Windows Defender issues
2.4
Scanning Your System Manually
Configuring Windows Defender Group Policy
Skills Matrix

5. Understanding Windows Firewall
A firewall is a device that limits inbound (and sometimes outbound) data connections in an attempt to strengthen security.
Windows Firewall is a host firewall that can run on each computer in a network to help prevent attacks.
Understanding Windows Firewall

6. Understanding Windows Firewall
Understanding Windows Firewall (cont.)
The following are some new features for Windows Firewall in Windows Vista.
Windows Firewall with Advanced Security Snap-in
IPSec integration
Outbound filtering
Expanded authenticated bypass
Support for Active Directory users, computers, and groups
Understanding Windows Firewall

7. Configuring Windows Firewall
You can configure the most basic settings for Windows Firewall through the Windows Firewall Settings dialog box.
More advanced settings can be configured by using the Windows Firewall with Advanced Security Snap-in and Group Policy.
Configuring Windows Firewall

8. Configuring Windows Firewall
Configuring Windows Firewall General Settings
The General tab enables you to turn Windows Firewall on or off and to block all inbound connections.
Configuring Windows Firewall

9. Configuring Windows Firewall
Configuring Windows Firewall Exceptions
Exceptions tab of the Windows Firewall Settings dialog box
Configuring Windows Firewall

10. Configuring Windows Firewall
Unblocking a Program in Windows Firewall
There are three ways to create an exception for an inbound connection request from a program.
Click Unblock on the Windows Security Alert dialog box when Windows Firewall blocks a program.
Configure a program exception on the Exceptions tab.
Configuring Windows Firewall

11. Configuring Windows Firewall
Unblocking a Program in Windows Firewall (cont.)
There are three ways to create an exception for an inbound connection request from a program (cont.).
Open the appropriate port on the Exceptions tab. This method is not recommended for individual programs.
Configuring Windows Firewall

12. Configuring Windows Firewall
Unblocking a Program in Windows Firewall (cont.)
Select one of the following:
Any computer (including those on the Internet) – Select this option to unblock the specified program for all computers.
My network (subnet) only – Select this option to unblock the specified program for your subnet.
Custom List – Select this option to specify the IP addresses of the computers for which you want to unblock the specified program.
Configuring Windows Firewall

13. Configuring Windows Firewall
Unblocking a Port in Windows Firewall
To add a port that is not in the list box, click Add port. The Add a Port dialog box appears.
Configuring Windows Firewall

14. Configuring Windows Firewall
Configuring the Advanced Tab in Windows Firewall
Do one of the following:
To enable Windows on a network connection – Select the check box for the network connection for which you want to enable Windows Firewall.
To disable Windows on a network connection – Clear the check box for the network connection for which you want to disable Windows Firewall.
Configuring Windows Firewall

15. Configuring Windows Firewall
Configuring the Advanced Tab in Windows Firewall (cont.)
Do one of the following (cont.):
To restore Windows Firewall default settings – Click Restore Defaults. In the Restore Defaults Confirmation warning box, click Yes to continue.
Configuring Windows Firewall

16. Configuring Windows Firewall
Configuring Windows Firewall with Advanced Security
Windows Firewall with Advanced Security Snap-in
Configuring Windows Firewall

17. Configuring Windows Firewall
Creating and Configuring Firewall Rules
Firewall Rules are the building blocks of exceptions.
You can configure Firewall Rules for both inbound and outbound connections.
Configuring Windows Firewall

18. Configuring Windows Firewall
Creating and Configuring Firewall Rules (cont.)
In the Action menu, click New Rule. The New Inbound/Outbound Rule Wizard appears.
Configuring Windows Firewall

19. Configuring Windows Firewall
Creating and Configuring Firewall Rules (cont.)
Select one of the following:
Apply to all programs and services – Applies the rule to all processes
Apply to services only – Applies the rule only to services
Configuring Windows Firewall

20. Configuring Windows Firewall
Creating and Configuring Firewall Rules (cont.)
Select one of the following (cont.):
Apply to this service – To select the service in the associated list box to which you want to apply the rule
Apply to service with this service short name – To select the service to which you want to apply the rule by specifying its short name
Configuring Windows Firewall

21. Configuring Windows Firewall
Creating and Configuring Firewall Rules (cont.)
Protocol and Ports page of the New Inbound Rule Wizard
Configuring Windows Firewall

22. Configuring Windows Firewall
Creating and Configuring Firewall Rules (cont.)
Scope page of the New Inbound Rule Wizard with example settings
Configuring Windows Firewall

23. Configuring Windows Firewall
Creating and Configuring Firewall Rules (cont.)
Action page of the New Inbound Rule Wizard
Configuring Windows Firewall

24. Configuring Windows Firewall
Creating a Program Inbound or Outbound Rule
Program page of the New Inbound Rule Wizard
Configuring Windows Firewall

25. Configuring Windows Firewall
Creating a Port Inbound or Outbound Rule
Protocol and Ports page of the New Inbound Rule Wizard
Configuring Windows Firewall

26. Configuring Windows Firewall
Creating a Predefined Inbound or Outbound Rule
Possible choices for predefined rules with Windows Meeting Space selected
Configuring Windows Firewall

27. Configuring Windows Firewall
Creating a Predefined Inbound or Outbound Rule (cont.)
Predefined Rules page for the Windows Meeting Space predefined rule
Configuring Windows Firewall

28. Configuring Windows Firewall
Browsing Rules in Windows Firewall with Advanced Security
In the console tree, select one of the three rules nodes.
Inbound Rules
Outbound Rules
Connection Security Rules
Configuring Windows Firewall

29. Configuring Windows Firewall
Browsing Rules in Windows Firewall with Advanced Security (cont.)
In the action pane, there are three filters with which you can filter the list (two for Connection Security Rules).
Filter by Profile – To limit the list according to what profile the rules affect
Filter by State – To show all of the rules that are enabled or disabled
Configuring Windows Firewall

30. Configuring Windows Firewall
Browsing Rules in Windows Firewall with Advanced Security (cont.)
In the action pane, there are three filters with which you can filter the list (two for Connection Security Rules) (cont.).
Filter by Group (Outbound Rules and Inbound Rules only) – To view all of the rules in a particular group
Configuring Windows Firewall

31. Configuring Windows Firewall
Configuring Windows Firewall Group Policy Settings
Windows Firewall Group Policy settings allow you to configure settings that control Windows Firewall behavior for many computers simultaneously through Group Policy.
Configuring Windows Firewall

32. Configuring Windows Firewall
Configuring Windows Firewall Group Policy Settings (cont.)
Domain profile – The affected computers are connected to a network where domain controllers (in which the computer’s domain account resides) are available.
Standard profile – The affected computers are not connected to a network where domain controllers (in which the computer’s domain account resides) are available.
Configuring Windows Firewall

33. Configuring Windows Firewall
Disabling Windows Firewall Through Group Policy
Protect all network connections Properties dialog box with Disabled selected
Configuring Windows Firewall

34. Understanding Windows Defender
Windows Defender is Vista’s front-line defense against spyware and other unwanted software.
Spyware includes programs from pop-up advertisements to applications that gather data from your computer and send it across the Internet.
Understanding Windows Defender

35. Using Windows Defender
Configuring Windows Defender Options Locally
Tools and Settings page of Windows Defender
Using Windows Defender

36. Using Windows Defender
Configuring Windows Defender Options Locally (cont.)
You can configure the following sets of options on the Options page of Windows Defender.
Automatic scanning
Default actions
Real-time protection options
Advanced options
Administrator options
Using Windows Defender

37. Using Windows Defender
Configuring Default Actions
Select one of the following options in the High alert items, Medium alert items, and Low alert items drop-down lists.
Default action (definition based) – Does what the virus definition recommends doing. This is the recommended setting.
Ignore – Ignores the detected program. This is not recommended, especially for high and medium alert items.
Using Windows Defender

38. Using Windows Defender
Configuring Default Actions (cont.)
Select one of the following options in the High alert items, Medium alert items, and Low alert items drop-down lists (cont.).
Remove – Removes the detected item automatically
Using Windows Defender

39. Using Windows Defender
Configure Real-Time Protection Options
Real-time protection options on the Options page of Windows Defender
Using Windows Defender

40. Using Windows Defender
Configuring Advanced Options
Configure the following check boxes:
Scan the contents of the archived files and folders for potential threats
Use heuristics to detect potentially harmful or unwanted behavior by software that hasn’t been analyzed for risks
Create a restore point before applying actions to detected items: Select if you may need to roll back a change made by Windows Defender.
Using Windows Defender

41. Using Windows Defender
Configuring Administrator Options
Open the Options page of Windows Defender.
Scroll to the Administrator options section.
If you want to turn on Windows Defender, select the Use Windows Defender check box.
To limit Windows Defender use to Administrators, clear the Allow everyone to use Windows Defender check box.
Using Windows Defender

42. Using Windows Defender
Using Software Explorer
Software Explorer is a component of Windows Defender that enables you to view detailed information and control software (including configuring startup options) on your computer that may have a negative impact on performance, privacy, or security.
Using Windows Defender

43. Using Windows Defender
Using Software Explorer (cont.)
You can explore the following categories of software in Software Explorer.
Startup programs – Programs that run automatically with or without your knowledge when you start Windows
Currently running programs – Programs or processes currently running
Using Windows Defender

44. Using Windows Defender
Using Software Explorer (cont.)
You can explore the following categories of software in Software Explorer (cont.).
Network-connected programs – Programs or processes that can connect to the Internet or to your home or office network
Winsock service providers – Programs that perform low-level networking and communication services and often have access to important areas of the operating system
Using Windows Defender

45. Using Windows Defender
Exploring Software Using Software Explorer
Software Explorer in Windows Defender
Using Windows Defender

46. Using Windows Defender
Scanning Your System and Taking Action with Windows Defender
Quick Scan – Select this option to scan the most likely areas where unwanted software resides.
Full Scan – Select this option to scan the entire computer.
Using Windows Defender

47. Using Windows Defender
Scanning and Taking Action with Windows Defender (cont.)
Custom Scan – Select this option to specify the files and folders that you want to scan. You can use this option if you suspect a particular piece of undesirable software and know where it usually resides.
Using Windows Defender

48. Using Windows Defender
Scanning and Taking Action with Windows Defender (cont.)
Reviewing example scan results in Windows Defender after a full system scan
Using Windows Defender

49. Using Windows Defender
Configuring Windows Defender Group Policy
Windows Defender Group Policy settings are located in the Computer Configuration > Administrative Templates > Windows Components > Windows Defender folder of GPOs.
Using Windows Defender

50. Using Windows Defender
Accessing Windows Defender Group Policy Settings
Open the Group Policy object for which you want to configure Group Policy.
In the Group Policy Object Editor console tree, expand Computer Configuration > Administrative Templates > Windows Components, and then select Windows Defender.
Using Windows Defender

51. Using Windows Defender
Accessing Windows Defender Group Policy Settings (cont.)
In the details pane, right-click the policy setting that you want to configure, and then click Properties.
Using Windows Defender

52. You Learned
Windows Firewall is a host firewall that can run on each computer in a network to help prevent attacks.
You learned how to configure basic Windows Firewall settings through the Windows Firewall Settings dialog box and to configure more advanced settings by using the Windows Firewall with Advanced Security Snap-in, whether locally or in Group Policy.
Summary

53. You Learned (cont.) Summary
You learned how to create Firewall Rules, which are the building blocks of exceptions and can be configured for both inbound and outbound connections.
The purpose of Windows Defender is to block, find, and remove malicious software, including spyware.
You learned how to schedule scanning and launch manual scans in Windows Defender.
Summary

54. You Learned (cont.) Summary
You learned how to configure settings for Windows Defender through Group Policy.
You learned how to use Software Explorer to view detailed information and control software (including configuring startup options) on your computer that may have a negative affect.
Summary