Windows Firewall with Advanced Security: How to Use Host-Based Rules for Lateral Movement Prevention

The core pattern: block inbound SMB and WMI/RPC from the workstation IP range, except from designated management servers and DCs.

Define your IP groups before writing rules:

• Workstation subnets (e.g., 10.10.0.0/16)
• Management server IPs (your jump servers, monitoring systems, SCCM/Intune, vulnerability scanners)
• Domain controller IPs
• Server subnets (to be exempted from workstation-to-workstation rules)

The three rules that matter most for workstation isolation:

1. Block inbound SMB from workstations: Prevents SMB lateral movement (PsExec, Impacket, standard admin shares)
2. Block inbound WMI/DCOM from workstations: Prevents WMI-based lateral movement (wmiexec, Invoke-WMIMethod)
3. Block inbound RDP from workstations (optional): Prevents RDP pivoting between workstations

Exceptions required:

• Allow SMB from DCs (Group Policy, SYSVOL, Netlogon)
• Allow SMB from management servers (SCCM, monitoring agents, backup)
• Allow WMI from monitoring systems
• Allow RDP from jump servers / PAWs only

Create a GPO applied to the Workstations OU.

Group Policy path: Computer Configuration > Windows Settings > Security Settings > Windows Firewall with Advanced Security > Windows Firewall with Advanced Security > Inbound Rules

Rule 1: Block inbound SMB from workstation subnets (except management)

• Right-click Inbound Rules > New Rule
• Rule type: Custom
• Program: All programs
• Protocol: TCP, Local port: 445
• Scope > Remote IP addresses: [Your workstation subnets, e.g., 10.10.0.0/16]
• Action: Block the connection
• Profile: Domain, Private, Public
• Name: WFAS-BLOCK-SMB-From-Workstations

Rule 2: Allow SMB from management servers (process BEFORE the block rule):

• Same settings but:
• Remote IP addresses: [Your management server IPs, DC IPs]
• Action: Allow the connection
• Name: WFAS-ALLOW-SMB-From-Management
• Order matters: Allow rules are evaluated before Block rules with the same specificity. Use GPO rule ordering or naming conventions to verify the allow rule is not overridden.

Deploy and verify with PowerShell:

# Verify rules are applied on an endpoint after GPO applies
Get-NetFirewallRule | Where-Object { $_.Name -like 'WFAS-*' } |
    Select-Object Name, Enabled, Action, Direction

# Test: try to connect to SMB on a workstation from another workstation
# (should be blocked after the rule applies)
Test-NetConnection -ComputerName [workstation-IP] -Port 445
# Expected: TcpTestSucceeded : False

# Verify the firewall profile is active (Domain profile should be active on domain-joined machines)
Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction

Connection security rules enforce IPsec authentication for connections between machines. Domain isolation uses them to ensure only domain-joined machines can reach protected servers.

Basic domain isolation setup:

GPO for all domain members: Computer Configuration > Windows Settings > Security Settings > Windows Firewall with Advanced Security > Connection Security Rules

• New Rule > Isolation
• Require authentication for inbound and outbound connections
• Authentication method: Computer and User (Kerberos V5)
• Profile: Domain
• Name: Domain-Isolation-Require-Auth

This causes all domain members to request IPsec authentication for connections to each other. Machines that cannot authenticate (non-domain devices) cannot connect to domain members on protected ports.

Server isolation (for sensitive servers):

GPO on the Servers OU -- restrict inbound connections to domain-authenticated sources only:

# Connection security rule on the server:
# Require authentication: Inbound connections must be authenticated
# Allowed membership: Specific AD group (e.g., 'Authorized-Server-Access')
# This supplements WFAS inbound filter rules with identity-based authentication

Exemptions for non-domain devices: Create an IPsec exemption for devices that cannot do Kerberos (printers, IoT, non-Windows devices):

• New Connection Security Rule > Authentication exemption
• Specify the IP addresses of non-domain devices to exempt

Audit all active firewall rules on an endpoint:

# Full WFAS rule dump
Get-NetFirewallRule -PolicyStore ActiveStore |
    Get-NetFirewallPortFilter |
    Select-Object @{N='Name';E={$_.InstanceID}}, Protocol, LocalPort, RemotePort |
    Export-Csv C:\WFAS-Audit.csv -NoTypeInformation

# Find rules that allow inbound SMB
Get-NetFirewallRule -Direction Inbound -Action Allow |
    Where-Object { $_.Enabled -eq 'True' } |
    Get-NetFirewallPortFilter |
    Where-Object { $_.LocalPort -eq '445' -or $_.LocalPort -eq 'Any' }

Check the current firewall profile and default actions:

Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction, DefaultOutboundAction
# For domain-joined machines, Domain profile should be: Enabled=True, DefaultInboundAction=Block
# If DefaultInboundAction=Allow, all inbound traffic is allowed by default
# (explicit block rules still work, but the posture is permissive)

Test that workstation isolation is effective:

# From WorkstationA, try to reach WorkstationB's SMB
Test-NetConnection -ComputerName [WorkstationB-IP] -Port 445
# Expected after rule deployment: TcpTestSucceeded : False
# TcpTestSucceeded : True means the rule is not applied or has an exception

# From a management server, verify management access still works:
Test-NetConnection -ComputerName [WorkstationA-IP] -Port 445
# Expected: TcpTestSucceeded : True (management server is exempted)